MLflow flaw allows arbitrary file read via prompt model versions

MLflow 3.10.0 through 3.16.1 contain a path traversal vulnerability tracked as CVE-2026-116690 with a CVSS score of 7.5. Attackers can register a prompt-tagged model version with a relative source path and download arbitrary server files via the API. The flaw is fixed in MLflow 3.17.0.

• Affects MLflow 3.10.0 to 3.16.1, patched in 3.17.0
• CVSS 7.5: unauthenticated file read on default deployments
• Public proof-of-concept published in GHSA-m65p-9j7q-6w33
• Malicious model version created via /api/2.0/mlflow/model-versions/create