GPU VulnDB

Database/AI/ML frameworks & serving

MLflow: schemeless prompt source lets a caller read arbitrary files readable by the tracking server

CVSS 7.5CVE-2026-116690AI/ML frameworks & servingcurated

Impact

Path validation in _create_model_version() only runs when the source has a URL scheme, and the mlflow.prompt.is_prompt marker is honoured by tag presence rather than value. A caller can therefore register a model version whose artifact location is a bare server-local path and then read that file through /api/2.0/mlflow/model-versions/get-artifact. Anything the MLflow server process can read comes back: artifact-store and object-store credentials, cloud instance metadata caches, Kubernetes service account tokens if it runs in-cluster, and other tenants' model artifacts on a shared tracking server. On a GPU fleet the tracking server usually holds the keys to the model bucket that every training and serving job pulls from, so this is a path from an HTTP endpoint to the credentials behind the whole model supply chain. Affects 3.10.0 up to 3.17.0.

Who can reach it

Anyone who can reach the MLflow tracking server over HTTP. Default MLflow ships without authentication, so no credentials are needed; on basic-auth deployments any authenticated user who may create a registered model can do it.

What to do

Upgrade MLflow to 3.17.0 and restart the tracking server - a daemon restart, no node drain, though clients may see a short window of failed logging. Until then keep the tracking server off any network a tenant can reach, put authentication in front of it, and rotate the artifact-store and cloud credentials held by the server process if exposure is suspected.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-116690https://github.com/mlflow/mlflow/security/advisories/GHSA-m65p-9j7q-6w33https://github.com/mlflow/mlflow/commit/81730a2ce4ebcd60d5d18f68c96f422ad7e30772https://github.com/mlflow/mlflow/releases/tag/v3.17.0

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.