Zero Radar
← feed
HighVulnerabilityCVE-2026-116690updated 27 Oct 2026, 21:27 UTC

MLflow server can be tricked into leaking files from its own disk

Someone who can talk to your MLflow server can register a model whose 'source' points at a folder on the server itself, then download files from that folder. This can expose secrets such as passwords stored on the server.

Fixed in MLflow 3.17.0Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesMLflow 3.17.0 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCreates prompt model version with relative path source
  2. 2Server stores pathSchemeless path skips validation and is saved
  3. 3Artifact endpoint runsServes files from the stored location
  4. 4Server files readIncludes configs, secrets, auth database
  5. ResultAttacker reads files from the server

What happened

In MLflow 3.10.0 through 3.16.1, prompt-tagged model versions accept schemeless relative paths as artifact sources, because path validation only runs for sources with a URL scheme; the get-artifact endpoint then serves files from those paths with the server process's privileges. The prompt tag is also checked by presence rather than value.

Why it is dangerous: Anyone able to reach the server can read arbitrary server files, including credentials and, on basic-auth servers, the authentication database with the admin password hash. Low-privilege authenticated users can escalate to admin-level data access.

Are you affected?

You are affected if you run MLflow 3.10.0 through 3.16.1, especially an unauthenticated tracking server (the default for mlflow server) or a basic-auth deployment where users can create registered models.

Package / productAffected versionsFixed in
mlflow · pip>= 3.10.0, < 3.17.03.17.0

What to do

  1. Upgrade MLflow to 3.17.0 or later (pip install -U 'mlflow>=3.17.0')
  2. If you cannot upgrade now, restrict network access to the MLflow server to trusted users only
  3. Turn on authentication and limit who can create registered models, then review the server's logs for unusual model version creation

Timeline

  1. 27 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 20:21 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 21:27 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 21:27 UTC
    Fixed version published: mlflow 3.17.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116690 · GHSA-m65p-9j7q-6w33
CVSS
7.5 / 10
EPSS
0.6% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 20:17 UTC
On Zero Radar
27 Oct 2026, 20:21 UTC (4 min after disclosure)
Last change
27 Oct 2026, 21:27 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

MLflow server can be tricked into leaking files from its own disk · Zero Radar