Skip to content
Fencer Intel
high 7.5

CVE-2026-2614 json

Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow

published 5mo ago modified 2mo ago also BIT-mlflow-2026-2614 , EUVD-2026-29180 , GHSA-42h5-h8qh-vv9v , PYSEC-2026-2654

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.6%
EPSS 3.6% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known, plus a Nuclei check

Summary

A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.

Patch / fix

  • pypi mlflow 3.10.0
  • bitnami mlflow 3.10.0
  • mlflow mlflow/mlflow 3.10.0
  • Red Hat Red Hat OpenShift AI 3.3 1782991170
  • Red Hat Red Hat OpenShift AI 3.4 1782132240, 1782135346, 1782135464, 1782136276, 1787073451, 1787073459, 1787073546, 1787073593, 1787073605, 1787073611, 1787073713, 1787073717, 1787073866, 1787073873, 1787074331, 1787121387

Is CVE-2026-2614 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-2614 updated cvss 7.5

mlflow: mlflow: Arbitrary file read via bypassed source path validation

  • Red Hat OpenShift AI (RHOAI) rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift AI 3.3 rhoai/odh-training-cuda128-torch29-py312-rhel9 1782991170
    fixed: vendor fix RHSA-2026:37275
  • Red Hat OpenShift AI 3.4 rhoai/odh-th06-cpu-torch210-py312-rhel9 1782135464, rhoai/odh-th06-rocm64-torch291-py312-rhel9 1782135346, rhoai/odh-th06-cuda130-torch210-py312-rhel9 1782136276, rhoai/odh-training-cuda128-torch29-py312-rhel9 1782132240, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1787073873, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1787073611, +11 more
    fixed: vendor fix RHSA-2026:60520
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1782471642, rhoai/rhai-cli-rhel9 1782471642, rhoai/odh-mlflow-rhel9 1782917849, rhoai/odh-trainer-rhel9 1782471656, rhoai/odh-maas-api-rhel9 1782996644, rhoai/odh-mlserver-rhel9 1782887848, +76 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1782132151, rhoai/odh-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1782132151, rhoai/rhai-cli-rhel9 1787330837, rhoai/odh-automl-rhel9 1782134058, rhoai/odh-automl-rhel9 1786612415, +189 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
5mo ago

Exploit prediction

3.63% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Nuclei template MLflow <= 3.9.0 - Arbitrary File Read nuclei detection template
  • huntr.com https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi mlflow
<3.10.0
3.10.0
bitnami mlflow
<3.10.0
3.10.0

Affected products

  • mlflow mlflow/mlflow
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.