A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Lfprojects
  • Mlflow
Mlflow
  • Mlflow/mlflow

Configuration 1 [-]

cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a cve-icon cve-icon cve-icon
https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6 cve-icon cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-2614 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-2614 cve-icon
History

Wed, 03 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

threat_severity

Important

Wed, 27 May 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Lfprojects
Lfprojects mlflow
CPEs cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*
Vendors & Products Lfprojects
Lfprojects mlflow

Tue, 12 May 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 11 May 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Mlflow
Mlflow mlflow/mlflow
Vendors & Products Mlflow
Mlflow mlflow/mlflow

Mon, 11 May 2026 19:30:00 +0000

Type Values Removed Values Added
Description A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.
Title Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow
Weaknesses CWE-22
References
Metrics cvssV3_0

{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published: 2026-05-11T19:02:46.025Z

Updated: 2026-05-12T13:33:20.949Z

Reserved: 2026-02-17T06:46:27.686Z

Link: CVE-2026-2614

cve-icon Vulnrichment

Updated: 2026-05-12T13:33:09.196Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-11T20:25:41.423

Modified: 2026-05-27T18:57:06.770

Link: CVE-2026-2614

cve-icon Redhat

Severity : Important

Publid Date: 2026-05-11T19:02:46Z

Links: CVE-2026-2614 - Bugzilla