{"id":"CVE-2026-2614","title":"A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem","summary":"A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22","CWE-22"],"vendor":"lfprojects","product":"mlflow","affected":["mlflow < 3.10.0"],"patched":["mlflow 3.10.0"],"published":"2026-05-11","updated":"2026-07-02","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-2614","references":[{"url":"https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a","label":"security@huntr.dev"},{"url":"https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6","label":"security@huntr.dev"},{"url":"https://access.redhat.com/errata/RHSA-2026:34456","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-2614","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469309","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2614.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd","exploit-available"],"epss":0.03608,"epssPercentile":0.88974,"ingestedAt":"2026-07-02T13:35:59.402Z","exploits":{"nuclei":["CVE-2026-2614"],"checkedAt":"2026-09-24T07:53:01.272Z"},"exploitAvailable":true,"slug":"CVE-2026-2614","body":"## Overview\n\nA vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.\n\n## Affected\n\n- `mlflow < 3.10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `mlflow 3.10.0`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.7,"exploitation":12,"ransomware":0},"changes":[{"seq":5045,"id":"CVE-2026-2614","ts":1788887230338,"field":"exploit_available","old":"false","new":"true"},{"seq":3928,"id":"CVE-2026-2614","ts":1788886361096,"field":"exploit_available","old":"true","new":"false"},{"seq":2750,"id":"CVE-2026-2614","ts":1788883027848,"field":"exploit_available","old":"false","new":"true"},{"seq":1779,"id":"CVE-2026-2614","ts":1788882430849,"field":"exploit_available","old":"true","new":"false"},{"seq":885,"id":"CVE-2026-2614","ts":1788881864133,"field":"exploit_available","old":"false","new":"true"}]}