MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

GHSA-42h5-h8qh-vv9v · BIT-mlflow-2026-2614 · CVE-2026-2614 · PYSEC-2026-2654 · 갱신 2026. 7. 14.

생태계	패키지	수정 버전
PyPI	mlflow	3.10.0

A vulnerability in the _create_model_version() handler of mlflow/server/handlers.py in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a CreateModelVersion request includes the tag mlflow.prompt.is_prompt, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The get_model_version_artifact_handler() function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

영향 받는 패키지

원문

출처