/Vulnerability Library

MLflow <= 3.9.0 - Arbitrary File Read

CVE-2026-2614
Verified

Description

mlflow mlflow <= 3.9.0 contains a path traversal caused by bypassing source path validation via the mlflow.prompt.is_prompt tag in CreateModelVersion request, letting unauthenticated remote attackers read arbitrary files.

Severity

High

CVSS Score

7.5

Exploit Probability

4%

Affected Product

mlflow

Published Date

August 7, 2026

Template Author

str4k3r

CVE-2026-2614.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-2614
CWE ID:
cwe-22

References

https://github.com/mlflow/mlflow/security/advisorieshttps://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115ahttps://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6https://nvd.nist.gov/vuln/detail/CVE-2026-2614

Remediation Steps

Upgrade to version 3.10.0 or later.