{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mlflow-3.10.0-3.16.x/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-116690"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MLflow (3.10.0-3.16.x)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["LF Projects"],"content_html":"\u003cp\u003eMLflow versions 3.10.0 through 3.16.x contain a path traversal vulnerability in the \u003ccode\u003e_create_model_version()\u003c/code\u003e function. The application fails to properly validate source paths that lack a URL scheme, allowing remote users to supply server-local paths. An attacker can leverage the \u003ccode\u003e/api/2.0/mlflow/model-versions/get-artifact\u003c/code\u003e endpoint to access any file readable by the MLflow server process. This vulnerability impacts both unauthenticated instances and deployments utilizing basic authentication where the attacker possesses model registration privileges. This issue is resolved in MLflow version 3.17.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized reading of sensitive files located on the MLflow server's filesystem, potentially exposing credentials, configuration data, or other sensitive system artifacts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade MLflow to version 3.17.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict network access controls to limit access to the MLflow API to trusted IP addresses only.\u003c/li\u003e\n\u003cli\u003eReview MLflow server process permissions to ensure the service runs with the least privilege necessary, minimizing the impact of potential filesystem traversal.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T22:07:17Z","date_published":"2026-10-27T22:07:17Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mlflow-traversal/","summary":"MLflow versions 3.10.0 through 3.16.x contain a path traversal vulnerability allowing remote attackers to read arbitrary files from the server filesystem via the model-versions/get-artifact API.","title":"MLflow: Arbitrary file read via model version path validation (CVE-2026-116690)","url":"https://feed.craftedsignal.io/briefs/2026-10-mlflow-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - MLflow (3.10.0-3.16.x)","version":"https://jsonfeed.org/version/1.1"}