MLflow CVE-2026-2614

Vulnerable MLflow server (versions ≤3.9.0) must be network-accessible to the attacker. No authentication, user interaction, or non-default configuration required-CVSS vector PR:N/UI:N confirms exploitation against default installations. The CreateModelVersion API endpoint must be reachable (standard in all MLflow deployments with model registry enabled). Attackers need ability to send HTTP POST requests to the server and subsequent GET requests to retrieve artifacts. The vulnerability requires the attacker to know or guess valid model names for the registry, though arbitrary names can be created. Exploitation is NOT limited by the mlflow.prompt.is_prompt tag being a privileged or rare feature-any request can include this tag. Filesystem paths targeted for read access must be readable by the MLflow server process user (typically the application service account). Does not require local access, SSH, or prior foothold.

Real-world risk is HIGH. CVSS 7.5 accurately reflects the attack surface: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H). Any exposed MLflow server running default configurations of versions ≤3.9.0 is vulnerable to arbitrary file read by remote attackers. The attack requires only crafting a single HTTP request with specific JSON payload-no exploit chain complexity. However, exploitation likelihood depends on MLflow server exposure: internet-facing deployments face immediate risk, while internal-only deployments require network access. No EPSS score, KEV status, or public exploit availability data provided in input, suggesting discovery through responsible disclosure via huntr.com bug bounty rather than active exploitation campaigns. The GitHub commit (6e801f4) is public and provides implementation details attackers could use to develop exploits. Defenders should prioritize this for any MLflow server handling sensitive data or deployed in multi-tenant environments, as successful exploitation grants read access to filesystem artifacts including credentials, configuration files, and private model data.

An attacker identifies an internet-accessible MLflow server running version 3.9.0 through version fingerprinting. They send a CreateModelVersion HTTP POST request to the /api/2.0/mlflow/model-versions/create endpoint with JSON payload containing 'name': 'exfiltrate', 'source': '/etc/passwd', and 'tags': [{'key': 'mlflow.prompt.is_prompt', 'value': 'true'}]. The server accepts this request, storing /etc/passwd as the model version source without validation. The attacker then issues a GET request to /get-artifact or /model-versions/get-artifact endpoint referencing the created model version. The get_model_version_artifact_handler() function retrieves and returns the contents of /etc/passwd. The attacker repeats with different paths (e.g., /proc/self/environ for environment variables, application config files, SSH keys) to exfiltrate sensitive data.