# CVE-2026-116690: MLflow - Path Traversal

> Live exploitation tracking for CVE-2026-116690 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-116690

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** MLflow
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** enterprise_software, web_application

## Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.

## CrowdSec analysis

[CVE-2026-116690](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-116690) is a path traversal vulnerability in MLflow versions 3.10.0 through 3.16.x that can let remote attackers read files accessible to the MLflow server. Attackers can exploit model-version artifact paths through the artifact retrieval API; default unauthenticated deployments are exposed without credentials, while basic-auth deployments require an account able to create registered models. The issue is fixed in MLflow 3.17.0.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of November 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-116690 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target `/api/2.0/mlflow/model-versions/create` with a path-traversal source, marking it as a prompt, then access `/model-versions/get-artifact` to read files from the server filesystem.

## Timeline

- 2026-10-27: CVE Published. CVE-2026-116690 is published to NVD.
- 2026-11-03: Rule Released. CrowdSec releases a rule to detect CVE-2026-116690 exploitation attempts against the CrowdSec Network.
- 2026-11-04: First exploitation attempt seen by CrowdSec

## References

- https://github.com/mlflow/mlflow/security/advisories/GHSA-m65p-9j7q-6w33
- https://github.com/mlflow/mlflow/pull/25870
- https://github.com/mlflow/mlflow/releases/tag/v3.17.0
- https://github.com/mlflow/mlflow/commit/81730a2ce4ebcd60d5d18f68c96f422ad7e30772
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-116690.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-116690) follows observed exploitation activity for CVE-2026-116690. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.