Is CVE-2026-116690 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116690 being exploited in the wild.

How severe is CVE-2026-116690?

High severity, with a CVSS score of 7.5, published 27 October 2026.

Which products and versions are affected?

Mlflow 3.10.0 to 3.16.x; mlflow (PyPI) >= 3.10.0, < 3.17.0, ECOSYSTEM:introduced=3.10.0,fixed=3.17.0.

Is there a fix for CVE-2026-116690?

Yes. mlflow (PyPI): upgrade to 3.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116690 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116690?

Check whether you run Mlflow or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116690: MLflow path traversal in prompt model version artifact access

Q: Is there a fix for CVE-2026-116690?

Yes. mlflow (PyPI): upgrade to 3.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116690 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-116690?

Check whether you run Mlflow or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116690 · Severity: high · CVSS 7.5 · Published 2026-10-27

MLflow is an open-source platform for managing machine learning and AI models. An attacker can exploit a validation bypass in prompt model versions to store arbitrary server-local file paths as artifact locations, then read files accessible to the MLflow server process through the get-artifact API. On unauthenticated servers, no special privileges are required; on basic-auth deployments, any authenticated user can exploit this.

Technologies: Mlflow, mlflow (PyPI). Vendors: MLflow, PyPI.

Quick answers

Is CVE-2026-116690 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116690 being exploited in the wild.
How severe is CVE-2026-116690?: High severity, with a CVSS score of 7.5, published 27 October 2026.
Which products and versions are affected?: Mlflow 3.10.0 to 3.16.x; mlflow (PyPI) >= 3.10.0, < 3.17.0, ECOSYSTEM:introduced=3.10.0,fixed=3.17.0.
Is there a fix for CVE-2026-116690?: Yes. mlflow (PyPI): upgrade to 3.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116690 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116690?: Check whether you run Mlflow or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mlflow (PyPI): upgrade to 3.17.0 or later
```
pip install "mlflow>=3.17.0"
```

Technical details

The vulnerability exists in the _create_model_version() function where path validation only runs when a source has a URL scheme; schemeless relative paths bypass this check. The mlflow.prompt.is_prompt condition is checked by tag presence rather than requiring a true value, allowing attackers to craft requests that store local file paths as model version artifact locations. An attacker can then use /api/2.0/mlflow/model-versions/get-artifact to read arbitrary files within the server's access scope.

Affected products

MLflow MLflow 3.10.0 to 3.16.x

Identifiers

CVE-2026-116690
GHSA-m65p-9j7q-6w33

Timeline

2026-10-27: disclosed
2026-09-16: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.