MLflow: Arbitrary file read via model version path validation (CVE-2026-116690)

MLflow versions 3.10.0 through 3.16.x contain a path traversal vulnerability in the _create_model_version() function. The application fails to properly validate source paths that lack a URL scheme, allowing remote users to supply server-local paths. An attacker can leverage the /api/2.0/mlflow/model-versions/get-artifact endpoint to access any file readable by the MLflow server process. This vulnerability impacts both unauthenticated instances and deployments utilizing basic authentication where the attacker possesses model registration privileges. This issue is resolved in MLflow version 3.17.0.

Impact

Successful exploitation allows for unauthorized reading of sensitive files located on the MLflow server's filesystem, potentially exposing credentials, configuration data, or other sensitive system artifacts.

Recommendation

• Upgrade MLflow to version 3.17.0 or later immediately.
• Implement strict network access controls to limit access to the MLflow API to trusted IP addresses only.
• Review MLflow server process permissions to ensure the service runs with the least privilege necessary, minimizing the impact of potential filesystem traversal.