CVE-2026-116690

MLflow prompt model-version paths allow server-local file reads

MLflow · Prompt model-version registry

First documented disclosure · Review checkpoint

Summary

Prompt-tagged model versions can make the artifact endpoint return files from the server filesystem.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Schemeless source paths bypass prompt-specific path validation; tag presence selects the branch even when its value is false.

Conditions required

Reachable model-registry endpoints. No credentials on default unauthenticated servers; basic-auth deployments require a user able to create registered models.

Potential impact

Read files accessible to the MLflow process, including readable authentication databases and configuration.

Affected versions and configurations

MLflow >=3.10.0, <3.17.0.

Fix and mitigation status

3.17.0.

Practical next steps

Upgrade with the release’s documented database migration procedure; require authentication, restrict registry access and review potential credential-file exposure.

Operating lesson

Equivalent paths and false-valued security tags must receive the same validation.

Evidence and limits

The public fix PR began September 15, advisory October 13 and CVE October 27. This is a distinct follow-up to earlier model-source validation flaws; it is not evidence of compromise.

Sources