Description
A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
mlflow mlflow/mlflow
unspecified to < 3.10.0affected
References
- https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6 ↗
- https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a ↗
- https://access.redhat.com/security/cve/CVE-2026-2614 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2469309 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2614.json ↗
- https://access.redhat.com/errata/RHSA-2026:37275 ↗
- https://access.redhat.com/errata/RHSA-2026:60520 ↗
- https://access.redhat.com/errata/RHSA-2026:34456 ↗