Skip to content
Fencer Vulns
high 7.5

CVE-2026-2614 json

Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow

published 2026-05-11 5 mo ago modified 2026-09-08 2 mo ago also BIT-mlflow-2026-2614 , EUVD-2026-29180 , GHSA-42h5-h8qh-vv9v , PYSEC-2026-2654

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.6%
EPSS 3.6% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known, plus a Nuclei check

Summary

A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.

Patch / fix

  • pypi mlflow 3.10.0
  • bitnami mlflow 3.10.0
  • mlflow mlflow/mlflow 3.10.0
  • Red Hat Red Hat OpenShift AI 3.3 1782991170
  • Red Hat Red Hat OpenShift AI 3.4 1782132240, 1782135346, 1782135464, 1782136276, 1787073451, 1787073459, 1787073546, 1787073593, 1787073605, 1787073611, 1787073713, 1787073717, 1787073866, 1787073873, 1787074331, 1787121387

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-2614 updated cvss 7.5

mlflow: mlflow: Arbitrary file read via bypassed source path validation

  • Red Hat OpenShift AI (RHOAI) rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift AI 3.3 rhoai/odh-training-cuda128-torch29-py312-rhel9 1782991170
    fixed: vendor fix RHSA-2026:37275
  • Red Hat OpenShift AI 3.4 rhoai/odh-th06-cpu-torch210-py312-rhel9 1782135464, rhoai/odh-th06-rocm64-torch291-py312-rhel9 1782135346, rhoai/odh-th06-cuda130-torch210-py312-rhel9 1782136276, rhoai/odh-training-cuda128-torch29-py312-rhel9 1782132240, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1787073873, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1787073611, +11 more
    fixed: vendor fix RHSA-2026:60520
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1782471642, rhoai/rhai-cli-rhel9 1782471642, rhoai/odh-mlflow-rhel9 1782917849, rhoai/odh-trainer-rhel9 1782471656, rhoai/odh-maas-api-rhel9 1782996644, rhoai/odh-mlserver-rhel9 1782887848, +76 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1782132151, rhoai/odh-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1782132151, rhoai/rhai-cli-rhel9 1787330837, rhoai/odh-automl-rhel9 1782134058, rhoai/odh-automl-rhel9 1786612415, +189 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

3.63% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template MLflow <= 3.9.0 - Arbitrary File Read nuclei detection template
  • huntr.com https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi mlflow
<3.10.0
3.10.0
bitnami mlflow
<3.10.0
3.10.0

Affected products

  • mlflow mlflow/mlflow
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.