CVE-2026-116690 mlflow CVE debrief

Who should care

Defenders responsible for MLflow server configurations, especially those running without authentication or using basic authentication, should assess exposure to potential file read attacks and prioritize verification and remediation efforts.

Why it matters

CVE-2026-116690 is significant for defenders responsible for MLflow server configurations, especially those running without authentication or using basic authentication. The vulnerability allows for arbitrary file read attacks, potentially leading to unauthorized file access and data breaches. Defenders should prioritize verifying MLflow server configurations and updating to version 3.17.0 or later.

• Potential unauthorized file access
• Possible data breaches through file read attacks
• Need for verification of MLflow server configurations
• Priority for updating MLflow to version 3.17.0 or later

Technical summary

The MLflow tracking server is vulnerable to arbitrary file read attacks when running without authentication or using basic authentication. An attacker can create a model version tagged as a prompt with a schemeless local path, allowing them to read files from the server's filesystem. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the `CreateModelVersion` handler that rejects `file://` URIs and absolute paths but runs path validation only when the source carries a URL scheme. A schemeless value such as `../../etc`, a plain relative name, `.`, a percent-encoded path, or a Windows drive-letter path is therefore stored unchanged as the model version’s artifact location, and the `model-ersions

Defensive priority

Defenders should prioritize verifying MLflow server configurations, especially those running without authentication or using basic authentication, and assess exposure to potential file read attacks.

Recommended defensive actions

• Verify MLflow server configurations to ensure authentication is enabled
• Assess exposure of MLflow servers to potential file read attacks
• Update MLflow to version 3.17.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact on MLflow tracking servers running without authentication. However, the record of affected versions and remediation efforts is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.