CVE-2026-2614

Executive Summary

CVE-2026-2614 is a path traversal vulnerability in MLflow versions 3.9.0 and earlier that permits unauthenticated remote attackers to read arbitrary files from the server filesystem. The flaw exists in the model version creation and artifact retrieval handlers, where a specific prompt tag bypasses source path validation and allows an attacker-supplied local path to be stored and later served. Impact is rated High (CVSS 7.5) with full confidentiality loss on exposed MLflow instances; enterprise ML platforms and research environments running the service are primarily affected.

Technical Analysis

The vulnerability resides in mlflow/server/handlers.py within the _create_model_version() function. When a CreateModelVersion request contains the tag mlflow.prompt.is_prompt, the handler skips normal source URI validation and permits an arbitrary filesystem path to be recorded as the model version source. The get_model_version_artifact_handler() subsequently retrieves and serves content from this stored path without re-checking the prompt status flag. This results in a classic CWE-22 path traversal where an attacker can traverse to sensitive files such as /etc/passwd, application configuration, or private keys. The attack surface is the public MLflow REST API, typically exposed on port 5000, and requires no authentication or special privileges.

Exploitation Scenarios

1. Reconnaissance identifies exposed MLflow instances via Shodan or direct port scanning for the /api/2.0/mlflow endpoints.
2. The attacker issues a POST to /api/2.0/mlflow/model-versions/create containing the required model registry fields plus the tag mlflow.prompt.is_prompt and a source value such as file:///etc/passwd or ../../../sensitive/config.yaml.
3. The server accepts the request and persists the malicious source path as the model version.
4. The attacker then calls the artifact retrieval endpoint /api/2.0/mlflow/model-versions/get-artifact with the corresponding model version ID, causing get_model_version_artifact_handler() to read and return the target file contents. Post-exploitation yields direct access to any readable file on the host, enabling credential harvesting or further lateral movement within the container or VM.

Impact Assessment

Successful exploitation grants complete read access to the MLflow server filesystem, exposing model artifacts, environment variables, database credentials, and potentially cloud provider keys. Blast radius is high for organizations using MLflow as a shared model registry; a single compromised instance can leak intellectual property or enable supply-chain attacks against downstream ML pipelines. CVSS 7.5 reflects high confidentiality impact with low attack complexity and no authentication requirement.

Detection Guidance

Sigma Rule

title: MLflow Arbitrary File Read via Prompt Tag
id: 8f4c2a1b-9e3d-4f7a-8c2b-1d5e6f7a8b9c
status: experimental
description: Detects CreateModelVersion requests containing mlflow.prompt.is_prompt tag
logsource:
  category: webserver
  product: mlflow
detection:
  selection:
    http.method: POST
    http.uri|contains: "/api/2.0/mlflow/model-versions/create"
    http.post_body|contains: "mlflow.prompt.is_prompt"
  condition: selection
level: high

YARA Rule

rule MLflow_PromptTag_FileRead {
    meta:
        description = "Detects MLflow prompt tag used for path traversal"
    strings:
        $tag = "mlflow.prompt.is_prompt"
        $uri = "/model-versions/create"
    condition:
        $tag and $uri
}

Suricata IDS Rule

alert http any any -> $HOME_NET 5000 (msg:"MLflow CVE-2026-2614 File Read Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/2.0/mlflow/model-versions/create"; http.request_body; content:"mlflow.prompt.is_prompt"; classtype:web-application-attack; sid:20262614; rev:1;)

Elastic Detection

sequence by source.ip
  [http_request where url.path == "/api/2.0/mlflow/model-versions/create" and http.request.body.content like "*mlflow.prompt.is_prompt*"]
  [http_request where url.path like "/api/2.0/mlflow/model-versions/get-artifact*"]

Splunk SPL Query

index=mlflow sourcetype=access_combined 
| search uri="/api/2.0/mlflow/model-versions/create" 
| search post_body="*mlflow.prompt.is_prompt*" 
| stats count by src_ip, uri, post_body

Wazuh OSSEC Rule

<group name="mlflow,">
  <rule id="100026" level="12">
    <if_sid>31101</if_sid>
    <match>/api/2.0/mlflow/model-versions/create</match>
    <match>mlflow.prompt.is_prompt</match>
    <description>MLflow CVE-2026-2614 exploitation attempt detected</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations: Restrict network access to the MLflow API with firewall rules or reverse-proxy authentication; disable public model creation endpoints if not required.
2. Patch/upgrade steps: Upgrade all instances to MLflow 3.10.0 or later; verify the fix by confirming source path validation occurs regardless of prompt tags.
3. Long-term hardening: Implement mandatory authentication on all MLflow endpoints, run the service with least-privilege filesystem access, and deploy web application firewall rules to block suspicious prompt tags.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-2614
https://github.com/mlflow/mlflow/releases/tag/v3.10.0
https://osv.dev/vulnerability/CVE-2026-2614
https://huntr.com/bounties/CVE-2026-2614
No known threat actor campaigns or in-the-wild exploitation observed as of current reporting.