{"id":"CVE-2026-2614","published":"2026-05-11T19:02:46Z","modified":"2026-08-28T12:04:27Z","title":"Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow","vendor":"mlflow","product":"mlflow/mlflow","tier":"core","eol":null,"affectedVersions":[{"vendor":"mlflow","product":"mlflow/mlflow","versions":[">= unspecified, < 3.10.0"]}],"description":{"text":"A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.5,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03691,"percentile":0.89708,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-29","exploitedFirstSeen":"2026-08-29","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-2614","date":"2026-08-29"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6","tags":[]},{"url":"https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2614","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469309","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2614.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34456","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"mlflow","vulnerableRanges":["<3.10.0"],"patched":["3.10.0"],"from":["GHSA-42h5-h8qh-vv9v","PYSEC-2026-2654"],"provenance":"source"}],"advisories":[{"id":"GHSA-42h5-h8qh-vv9v","url":"https://github.com/advisories/GHSA-42h5-h8qh-vv9v","severity":"HIGH","ecosystem":"PyPI","package":"mlflow","vulnerableRanges":["<3.10.0"],"patched":["3.10.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-29180","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29180","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2026-2614","name":"MLflow <= 3.9.0 - Arbitrary File Read","severity":"high","path":"http/cves/2026/CVE-2026-2614.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2614.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-05-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-2614","provenance":"source"},{"date":"2026-08-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-2614","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":73.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 64 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.94,"detail":"percentile 0.8971"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}