MLflow EUVD-2026-111362

The MLflow tracking server must be network-reachable with model registry endpoints enabled, and affected by version (3.10.0 through 3.16.1). On the default configuration - mlflow server runs without authentication - no credentials are required: the attacker creates a registered model, then a model version carrying the mlflow.prompt.is_prompt tag with a schemeless relative source (e.g. '../../../tmp', '.', a percent-encoded path, or a Windows drive-letter path), which routes through the flawed prompt branch and is stored unvalidated; files are then read via /api/2.0/mlflow/model-versions/get-artifact. On --app-name basic-auth deployments the flaw is still exploitable, but limited to authenticated users whose RBAC allows creating registered models (default low-privilege accounts qualify). Further limits: file read is confined to paths readable by the MLflow server process, and servers on 3.17.0+ reject all schemeless prompt sources except MLflow's own placeholders.

This is a genuine priority, not an inflated high-CVSS issue. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, and the GHSA advisory confirms the dangerous premise behind PR:N: MLflow tracking servers run without authentication by default (mlflow server), so a remote caller truly needs no credentials. Impact is scoped to confidentiality only (C:H/I:N/A:N) - arbitrary local file read as the server process - which the advisory corroborates with concrete targets (/etc/passwd, tracking/auth SQLite databases including admin password hashes, .bash_history). Signals are mostly aligned rather than conflicting: the vuln.today Decision label is 'this_week' and a patch is available, while no CISA KEV listing and no verified working exploit temper the urgency. The one nuance to flag: a public PoC reference exists (a gist) but is not verified as working exploit code, and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified from the data given. The confidentiality chain is also potentially severe beyond simple file read - leaking the basic-auth database enables offline cracking of the admin hash and thus broader compromise.

A remote attacker reaches an internet- or network-exposed MLflow tracking server (unauthenticated by default) and creates a registered model, then a prompt-tagged model version whose source is a schemeless relative path like '../../../tmp'. They then call /api/2.0/mlflow/model-versions/get-artifact with a chosen filename to read arbitrary files readable by the server process, such as /etc/passwd or the auth database. A public PoC reference exists but is not verified as working exploit code; given AV:N and AC:L the attack requires only HTTP access and no special timing.