# CVE-2026-2614: MLflow/Mlflow - Path Traversal

> Live exploitation tracking for CVE-2026-2614 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-2614

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** MLflow/Mlflow
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** python, web_application

## Description

A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in MLflow/Mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.

## CrowdSec analysis

[CVE-2026-2614](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-2614) is a high-severity path traversal vulnerability in MLflow/Mlflow 3.9.0 and earlier that allows unauthenticated remote attackers to read arbitrary files from the server filesystem. By abusing the `mlflow.prompt.is_prompt` tag, attackers can bypass source-path validation and retrieve sensitive data, resulting in a complete compromise of confidentiality. The issue is fixed in version 3.10.0.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-2614 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-2614. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit MLflow's model version APIs by creating a registered model, submitting a `file:///etc/` source with the `mlflow.prompt.is_prompt=true` tag to bypass path validation, and then requesting files through `/model-versions/get-artifact`. Detection should focus on POST requests to `/api/2.0/mlflow/registered-models/create` and `/api/2.0/mlflow/model-versions/create`, followed by GET requests to `/model-versions/get-artifact` containing file-reading parameters such as `path=passwd`.

## Timeline

- 2026-05-11: CVE Published. CVE-2026-2614 is published to NVD.
- 2026-08-25: Rule Released. CrowdSec releases a rule to detect CVE-2026-2614 exploitation attempts against the CrowdSec Network.
- 2026-09-03: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-2614 for the first time.

## References

- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2614.json
- https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6
- https://access.redhat.com/errata/RHSA-2026:37275
- https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a
- https://access.redhat.com/security/cve/CVE-2026-2614
- https://bugzilla.redhat.com/show_bug.cgi?id=2469309
- https://access.redhat.com/errata/RHSA-2026:34456
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2614.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-2614) follows observed exploitation activity for CVE-2026-2614. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.