CrowdSecLive Exploit Tracker
Insufficient DataCVE-2026-116690Public Exploit

MLflow - Path Traversal (CVE-2026-116690)

PublishedOct 27, 2026
First SeenNov 4, 2026
Last Seen
Reported
CVSS7.5
MLflow
MLflowMLflow
enterprise_softwareweb_application

Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.

psychologyCrowdSec Analysis

CVE-2026-116690 is a path traversal vulnerability in MLflow versions 3.10.0 through 3.16.x that can let remote attackers read files accessible to the MLflow server. Attackers can exploit model-version artifact paths through the artifact retrieval API; default unauthenticated deployments are exposed without credentials, while basic-auth deployments require an account able to create registered models. The issue is fixed in MLflow 3.17.0.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of November 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-116690 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target /api/2.0/mlflow/model-versions/create with a path-traversal source, marking it as a prompt, then access /model-versions/get-artifact to read files from the server filesystem.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2026-10-27
Rule Released2026-11-03

Related Weaknesses

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References