Path traversal in MLflow - CVE-2026-116690
Published: November 9, 2026
Vulnerability identifier: #VU162801
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116690
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read arbitrary files accessible to the MLflow server process on tracking servers without authentication and with model registry endpoints enabled.
The vulnerability exists due to missing validation of schemeless relative source paths when creating prompt-tagged model versions. An unauthenticated remote attacker can create a model version pointing outside the artifact directory and retrieve sensitive server files, including tracking databases, through the artifact download endpoint.
Affected software
MLflow
How to mitigate CVE-2026-116690
Install security update from vendor's website.
MLflow - update to 3.17.0