MLflow/Mlflow - Path Traversal (CVE-2026-2614)

CVE-2026-2614 is a high-severity path traversal vulnerability in MLflow/Mlflow 3.9.0 and earlier that allows unauthenticated remote attackers to read arbitrary files from the server filesystem. By abusing the mlflow.prompt.is_prompt tag, attackers can bypass source-path validation and retrieve sensitive data, resulting in a complete compromise of confidentiality. The issue is fixed in version 3.10.0.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-2614 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-2614. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit MLflow's model version APIs by creating a registered model, submitting a file:///etc/ source with the mlflow.prompt.is_prompt=true tag to bypass path validation, and then requesting files through /model-versions/get-artifact. Detection should focus on POST requests to /api/2.0/mlflow/registered-models/create and /api/2.0/mlflow/model-versions/create, followed by GET requests to /model-versions/get-artifact containing file-reading parameters such as path=passwd.