CVE-2026-2614: Arbitrary File Access in MLflow

The impact of CVE-2026-2614 is significant due to its unauthenticated nature and the potential for widespread data exposure. An attacker can exploit this vulnerability by crafting a malicious CreateModelVersion request that includes the tag mlflow.prompt.isprompt. This bypasses the intended source path validation, allowing the attacker to specify an arbitrary local filesystem path as the model version source. Subsequently, the getmodelversionartifact_handler() function uses this path to serve files without proper verification, enabling the attacker to retrieve any file accessible to the MLflow server process. This could include configuration files, credentials, or even source code, leading to a complete compromise of the system. The blast radius extends to any environment running a vulnerable version of MLflow.

1. Veröffentlicht2026-05-11
2. Geändert2026-05-12
3. EPSS aktualisiert2026-05-13

The primary mitigation for CVE-2026-2614 is to upgrade to MLflow version 3.10.0 or later, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restrict network access to the MLflow server to only authorized clients. Implement strict file system permissions to limit the attacker's ability to access sensitive files, even if they manage to bypass the validation check. Monitor MLflow server logs for suspicious activity, particularly requests containing the mlflow.prompt.isprompt tag. Consider using a Web Application Firewall (WAF) to filter out malicious requests. After upgrading, confirm the fix by attempting to create a model version with a crafted mlflow.prompt.isprompt tag and verifying that the file access is properly blocked.