mlflow · mlflow/mlflow
A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.
First seen exploited 4 months after disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: mlflow.
Upgrade to 3.17.0 or later
Fixes this CVE and 11 other known vulnerabilities in this package (CVE-2023-1177, CVE-2023-2356, +9).
pip install "mlflow>=3.17.0"First fixed in 3.10.0 for CVE-2026-2614.
| If you run | Upgrade to |
|---|---|
| All versions before 3.10.0 | 3.17.0first fix for this CVE: 3.10.0 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.