CVE-2026-116690 in Mlflow
Summary
by MITRE • 10/27/2026
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within MLflow versions ranging from 3.10.0 through 3.17.0 represents a critical server-side path traversal and arbitrary file read flaw rooted in insufficient input validation during model registration processes. As an open-source platform for managing the machine learning lifecycle, MLflow handles sensitive artifacts including trained models, datasets, and configuration files. The core technical deficiency lies within the _create_model_version() function, which is responsible for establishing new versions of registered models. When a remote caller provides a source path for the model artifact, the system fails to adequately validate paths that lack an explicit URL scheme. This oversight allows attackers to supply server-local file system paths rather than legitimate URIs, effectively bypassing security controls designed to restrict access to external or sandboxed resources.
The mechanism of exploitation relies on the conditional logic used by MLflow to determine whether path validation should be enforced. The codebase checks for the presence of a URL scheme such as http, https, s3, or gs before applying strict sanitization rules. If no scheme is detected, the input is treated as a relative local path without undergoing rigorous scrutiny for directory traversal sequences like ../ or absolute path normalization. Consequently, an attacker can specify arbitrary file paths on the server's filesystem where MLflow is deployed. This flaw is compounded by how the system interprets prompt configurations; specifically, mlflow.prompt.is_prompt relies on tag presence rather than verifying a true boolean value, which may further obscure malicious intent during automated processing pipelines.
The operational impact of this vulnerability is severe, particularly for deployments that do not enforce strict authentication or those running with elevated privileges. In default unauthenticated setups, any remote actor can exploit the flaw to read arbitrary files accessible to the MLflow server process account. This includes sensitive configuration files containing database credentials, API keys, private SSH keys, and other secrets stored on the host machine. For deployments utilizing basic authentication, authenticated users who possess permissions to create registered models are similarly exposed. By leveraging this weakness, an attacker can exfiltrate critical infrastructure data, potentially leading to full system compromise if combined with other vulnerabilities or misconfigurations in the surrounding environment.
This issue aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-94 Improper Control of Generation of Code (Code Injection), as it allows unauthorized access to restricted file systems through manipulated input parameters. From an ATT&CK perspective, this vulnerability facilitates the T1083 File and Directory Discovery technique, enabling adversaries to map out sensitive data stores on compromised hosts for subsequent exfiltration via techniques such as Data from Information Repositories or Exfiltration Over Unencrypted Non-C2 Protocol when combined with artifact retrieval endpoints. The specific endpoint exploited is /api/2.0/mlflow/model-versions/get-artifact, which serves the requested file content directly to the requester after validation bypasses occur.
Mitigation strategies must prioritize immediate upgrading of MLflow instances to version 3.17.0 or later, where this path validation logic has been corrected to enforce strict checks regardless of URL scheme presence. Organizations should also implement network-level controls such as firewalls and reverse proxies to restrict access to the MLflow API endpoints exclusively from trusted internal networks. Additionally, enforcing strong authentication mechanisms is essential to prevent unauthenticated actors from interacting with model registration APIs. Running the MLflow service under a dedicated user account with minimal file system permissions can further limit the blast radius of any successful exploitation attempt by restricting read/write access to only necessary directories and files.