1[high] mlflow: MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version sourcegithub.comHigh10·27 21:26Z
A high-severity vulnerability, CVE-2026-116690, affects MLflow versions 3.10.0 through 3.16.1, allowing remote attackers to read arbitrary files from servers running without authentication by creating a prompt-tagged model version with a schemeless local path as its source1. The flaw bypasses a prior fix for CVE-2026-2614 because path validation runs only when the source carries a URL scheme. Servers using basic authentication are also exposed: any authenticated user can exploit the bug to read the authentication database, including admin password hashes. MLflow 3.17.0 patches the issue.