Database/AI/ML frameworks & serving
MLflow: unauthenticated arbitrary file read via prompt-tagged model version source path
Impact
An unauthenticated caller who can reach the MLflow tracking server can register a model version whose source is any local filesystem path, then retrieve that path's contents through the artifact handler. On a GPU fleet the tracking server usually runs with broad read access to the shared experiment store and the service account credentials used to pull training data and push images, so this reads out registry tokens, cloud credential files and other tenants' artifacts, not just model blobs. MLflow is commonly exposed cluster-wide to every team that trains on the cluster, so "unauthenticated" here often means any pod on the network. Confidentiality only - no write or code execution is claimed in the record.
Who can reach it
Anyone who can send HTTP requests to the MLflow tracking server. No authentication required.
What to do
Upgrade MLflow to 3.10.0 and restart the tracking server; the model registry stays intact, so this is a service restart rather than a node action. Red Hat has shipped errata for OpenShift AI 3.3 and 3.4 (RHSA-2026:34456, RHSA-2026:37275, RHSA-2026:60520) - apply those if MLflow arrives via RHOAI. Until patched, put authentication or a network policy in front of the tracking server and treat any credential readable by the server process as exposed.
References
Related entries
- Ray Dashboard: Path traversal in the dashboard static-file handler (port 8265)CVE-2026-32981 · Ray DashboardHigh
- LangChain: prompt config files are loaded from unvalidated paths, letting a caller read arbitrary host filesCVE-2026-34070 · LangChain langchain-core prompt loading (load_prompt / load_prompt_from_config)High
- vLLM: unbounded media download from user-supplied URLs exhausts inference server memoryCVE-2026-37237 · vLLM multimodal input fetcher (`AsyncMediaIO.fetch_audio` / `fetch_image`)High
- vLLM (activation function loading): Assert-based security check bypass, unauthenticatedCVE-2026-41523 · vLLM (activation function loading)High
- Spring AI: predictable ONNX model cache path lets a local user plant a substitute model fileCVE-2026-47852 · Spring AI (ONNX model cache path)High
- Ollama (quantization engine): Unauthenticated remote information disclosure — reads and exfiltrates model dataCVE-2026-5757 · Ollama (quantization engine)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.