AI Threat AlertMLflow 3.10.0 through 3.16.x has a flaw in its prompt model-version creation logic: schemeless relative sources skip path validation, so a remote caller can point a model version at a server-local path and read any file the MLflow server process can access through the get-artifact endpoint. It needs no privileges or user interaction on default unauthenticated servers, and only registered-model creation rights on basic-auth deployments, which makes it easy to exploit with a CVSS of 7.5. We have no EPSS data, no public exploit, no Nuclei template and no KEV listing, so there is no sign of active exploitation yet. MLflow servers commonly hold cloud credentials, tracking-database connection strings and proprietary model artifacts, so the confidentiality impact can reach well beyond MLflow itself. Upgrade to 3.17.0 now, put authentication in front of any exposed tracking server, and review access logs for calls to the get-artifact endpoint with unusual paths.
What is the risk?
High. The attack is network-reachable, low complexity, needs no privileges on default deployments and no user interaction. Impact is confined to confidentiality (arbitrary file read, bounded by the server process permissions), with no integrity or availability impact. Exposure is highest for internet-facing or broadly reachable MLflow tracking servers running the default no-auth configuration. There is no public exploit or KEV listing at publication, but the technique is simple enough that a working exploit should be easy to develop from the public patch and advisory.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| MLflow | pip | >= 3.10.0, < 3.17.0 | 3.17.0 |
Do you use MLflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
6 stepsUpgrade MLflow to 3.17.0 or later.
If patching is delayed, restrict network access to the tracking server (VPN, private subnet, reverse proxy allowlist) and enable authentication.
In basic-auth deployments, limit who can create registered models and prompts.
Run the MLflow server as a low-privilege user in a container with a minimal filesystem and no mounted secrets.
Detection: review web and application logs for model-version creation requests that carry the mlflow.prompt.is_prompt tag with a schemeless or relative source, and for model-versions/get-artifact calls returning non-artifact paths such as /etc/passwd or .env files.
Rotate any credentials stored on hosts that ran vulnerable, exposed versions.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-116690?
MLflow 3.10.0 through 3.16.x has a flaw in its prompt model-version creation logic: schemeless relative sources skip path validation, so a remote caller can point a model version at a server-local path and read any file the MLflow server process can access through the get-artifact endpoint. It needs no privileges or user interaction on default unauthenticated servers, and only registered-model creation rights on basic-auth deployments, which makes it easy to exploit with a CVSS of 7.5. We have no EPSS data, no public exploit, no Nuclei template and no KEV listing, so there is no sign of active exploitation yet. MLflow servers commonly hold cloud credentials, tracking-database connection strings and proprietary model artifacts, so the confidentiality impact can reach well beyond MLflow itself. Upgrade to 3.17.0 now, put authentication in front of any exposed tracking server, and review access logs for calls to the get-artifact endpoint with unusual paths.
Is CVE-2026-116690 actively exploited?
No confirmed active exploitation of CVE-2026-116690 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-116690?
1. Upgrade MLflow to 3.17.0 or later. 2. If patching is delayed, restrict network access to the tracking server (VPN, private subnet, reverse proxy allowlist) and enable authentication. 3. In basic-auth deployments, limit who can create registered models and prompts. 4. Run the MLflow server as a low-privilege user in a container with a minimal filesystem and no mounted secrets. 5. Detection: review web and application logs for model-version creation requests that carry the mlflow.prompt.is_prompt tag with a schemeless or relative source, and for model-versions/get-artifact calls returning non-artifact paths such as /etc/passwd or .env files. 6. Rotate any credentials stored on hosts that ran vulnerable, exposed versions.
What systems are affected by CVE-2026-116690?
This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, model registries, experiment tracking servers, training pipelines, model serving pipelines.
What is the CVSS score for CVE-2026-116690?
CVE-2026-116690 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.56%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0035AI Artifact CollectionAML.T0037Data from Local SystemAML.T0049Exploit Public-Facing ApplicationAML.T0055Unsecured CredentialsCompliance Controls Affected
What are the technical details?
Original Advisory
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.
Exploitation Scenario
An attacker finds an MLflow tracking server reachable from the internet or an internal network with no authentication. They create a registered model, then create a model version carrying the mlflow.prompt.is_prompt tag with a relative source pointing to a sensitive server path. They then call /api/2.0/mlflow/model-versions/get-artifact to download the file contents, harvesting cloud keys, database credentials and API tokens from the server. With those, they pull proprietary model artifacts from object storage and move into the wider ML and cloud environment.
Weaknesses (CWE)
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')PrimaryCWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')PrimaryCWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2025-1537910.0MLflow: RCE via unsanitized model dependency specs
Same package: mlflowCVE-2023-376510.0MLflow: path traversal allows arbitrary file read
Same package: mlflowCVE-2023-27809.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflowCVE-2026-26359.8mlflow: security flaw enables exploitation
Same package: mlflowCVE-2023-11779.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflow