{"advisories":[{"id":"GHSA-42h5-h8qh-vv9v","source":"ghsa","title":"MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem","url":"https://github.com/advisories/GHSA-42h5-h8qh-vv9v"}],"cve":"CVE-2026-2614","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[0,3.10.0)"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"mlflow/mlflow","source":"cna","vendor":"mlflow"},"product":"mlflow/mlflow","vendor":"mlflow"}],"created":"2026-05-11T20:30:15.824528+00:00","updated":"2026-08-15T21:45:02.512461+00:00","vendors":["mlflow","mlflow$PRODUCT$mlflow/mlflow"]},"epss":{"score":0.03206},"mitre":{"cpes":[],"created":"2026-05-11T19:02:46.025000+00:00","description":"A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.","metrics":{"cvssV2_0":{},"cvssV3_0":{"score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/2xxx/CVE-2026-2614.json","references":["https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a","https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6"],"title":"Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow","updated":"2026-08-28T12:04:27.071000+00:00","vendors":[],"weaknesses":["CWE-22"]},"nvd":{"cpes":["cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*"],"created":"2026-05-11T20:25:41.423000+00:00","description":"A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.","metrics":{"cvssV2_0":{},"cvssV3_0":{"score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-2614.json","references":["https://access.redhat.com/errata/RHSA-2026:34456","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/security/cve/CVE-2026-2614","https://bugzilla.redhat.com/show_bug.cgi?id=2469309","https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a","https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2614.json"],"title":null,"updated":"2026-08-28T16:17:23.703000+00:00","vendors":["lfprojects","lfprojects$PRODUCT$mlflow"],"weaknesses":["CWE-22"]},"opencve":{"changes":[{"created":"2026-05-11T19:30:00+00:00","data":[{"details":{"new":"A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.","old":null},"type":"description"},{"details":{"new":"Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow","old":null},"type":"title"},{"details":{"added":["CWE-22"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a","https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_0":{"score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"b403fc4e-4757-4962-ad4d-5cbb60c738b6"},{"created":"2026-05-11T20:45:00+00:00","data":[{"details":["mlflow","mlflow$PRODUCT$mlflow/mlflow"],"type":"first_time"},{"details":{"added":["mlflow","mlflow$PRODUCT$mlflow/mlflow"],"removed":[]},"type":"vendors"}],"id":"165b29fc-591c-47ed-9783-28792c6d47a8"},{"created":"2026-05-12T14:15:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"c20eb184-79dc-4c86-85ac-98c10176dd74"},{"created":"2026-05-27T19:00:00+00:00","data":[{"details":["lfprojects","lfprojects$PRODUCT$mlflow"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["lfprojects","lfprojects$PRODUCT$mlflow"],"removed":[]},"type":"vendors"}],"id":"b0334f17-81ba-449e-9017-4625cf22c82a"},{"created":"2026-06-03T02:30:00+00:00","data":[{"details":{"added":["https://nvd.nist.gov/vuln/detail/CVE-2026-2614","https://www.cve.org/CVERecord?id=CVE-2026-2614"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}},"removed":{},"updated":{"threat_severity":{"new":"Important","old":null}}},"type":"metrics"}],"id":"5bce51cf-dcb0-428d-a2ff-ee3864d7c526"},{"created":"2026-08-28T16:30:00+00:00","data":[{"details":{"added":["https://access.redhat.com/errata/RHSA-2026:60520"],"removed":[]},"type":"references"}],"id":"8bbdc72f-f2fc-4fb8-bfb0-5a3e326858ac"}],"cpes":{"data":["cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2026-05-11T19:02:46+00:00","provider":"redhat"},"description":{"data":"A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{"score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"provider":"mitre"},"cvssV3_1":{"data":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"provider":"nvd"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.03206},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":"Important","provider":"redhat"}},"references":{"data":["https://access.redhat.com/errata/RHSA-2026:34456","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/security/cve/CVE-2026-2614","https://bugzilla.redhat.com/show_bug.cgi?id=2469309","https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a","https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6","https://nvd.nist.gov/vuln/detail/CVE-2026-2614","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2614.json","https://www.cve.org/CVERecord?id=CVE-2026-2614"],"providers":["mitre","nvd","redhat","vulnrichment"]},"title":{"data":"Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow","provider":"mitre"},"updated":{"data":"2026-08-28T16:17:23.703000+00:00","provider":"nvd"},"vendors":{"data":["lfprojects","lfprojects$PRODUCT$mlflow","mlflow","mlflow$PRODUCT$mlflow/mlflow"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-22"],"providers":["mitre","nvd","redhat"]}},"redhat":{"cpes":[],"created":"2026-05-11T19:02:46+00:00","description":"A flaw was found in mlflow. An unauthenticated remote attacker can exploit a vulnerability in the `_create_model_version()` handler by including a specific tag, `mlflow.prompt.is_prompt`, in a `CreateModelVersion` request. This bypasses source path validation, allowing the attacker to specify an arbitrary local filesystem path as the model version source. Subsequently, the `get_model_version_artifact_handler()` function serves files from this unverified source, leading to the disclosure of arbitrary files from the server's filesystem and a complete confidentiality compromise.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"threat_severity":"Important"},"redhat_repo_path":"2026/CVE-2026-2614.json","references":["https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a","https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6","https://nvd.nist.gov/vuln/detail/CVE-2026-2614","https://www.cve.org/CVERecord?id=CVE-2026-2614"],"title":"mlflow: mlflow: Arbitrary file read via bypassed source path validation","updated":"2026-05-11T19:02:46+00:00","vendors":[],"weaknesses":["CWE-22"]},"vulnrichment":{"cpes":[],"created":"2026-05-11T19:02:46.025000+00:00","description":"A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"poc","Technical Impact":"partial"},"version":"2.0.3"}},"references":["https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6"],"title":"Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow","updated":"2026-05-12T13:33:09.196000+00:00","vendors":[],"vulnrichment_repo_path":"2026/2xxx/CVE-2026-2614.json","weaknesses":[]}}