# CVE-2026-116690: MLflow path traversal in prompt model version artifact access

Source: https://junglewise.ai/threats/cve-2026-116690-mlflow-is-an-open-source-ai-engineering-platform-for-agents  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116690 · Severity: high · CVSS 7.5 · Published 2026-10-27

MLflow is an open-source platform for managing machine learning and AI models. An attacker can exploit a validation bypass in prompt model versions to store arbitrary server-local file paths as artifact locations, then read files accessible to the MLflow server process through the get-artifact API. On unauthenticated servers, no special privileges are required; on basic-auth deployments, any authenticated user can exploit this.

Technologies: [Mlflow](https://junglewise.ai/threats/technologies/mlflow-mlflow), [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow). Vendors: [MLflow](https://junglewise.ai/threats/vendors/mlflow), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-116690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116690 being exploited in the wild.

**How severe is CVE-2026-116690?** High severity, with a CVSS score of 7.5, published 27 October 2026.

**Which products and versions are affected?** Mlflow 3.10.0 to 3.16.x; mlflow (PyPI) >= 3.10.0, < 3.17.0, ECOSYSTEM:introduced=3.10.0,fixed=3.17.0.

**Is there a fix for CVE-2026-116690?** Yes. mlflow (PyPI): upgrade to 3.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116690 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116690?** Check whether you run Mlflow or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mlflow (PyPI): upgrade to 3.17.0 or later

  ```sh
  pip install "mlflow>=3.17.0"
  ```


## Technical details

The vulnerability exists in the _create_model_version() function where path validation only runs when a source has a URL scheme; schemeless relative paths bypass this check. The mlflow.prompt.is_prompt condition is checked by tag presence rather than requiring a true value, allowing attackers to craft requests that store local file paths as model version artifact locations. An attacker can then use /api/2.0/mlflow/model-versions/get-artifact to read arbitrary files within the server's access scope.

## Affected products

- MLflow MLflow 3.10.0 to 3.16.x

## Identifiers

- CVE-2026-116690
- GHSA-m65p-9j7q-6w33

## Timeline

- 2026-10-27: disclosed
- 2026-09-16: patched

## References

- [https://github.com/mlflow/mlflow/commit/81730a2ce4ebcd60d5d18f68c96f422ad7e30772](https://github.com/mlflow/mlflow/commit/81730a2ce4ebcd60d5d18f68c96f422ad7e30772)
- [https://github.com/mlflow/mlflow/pull/25870](https://github.com/mlflow/mlflow/pull/25870)

## Related threats

- [MLflow path traversal in FileStore log outputs API](https://junglewise.ai/threats/cve-2026-127202-mlflow-before-3-18-0-using-the-filestore-backend-contains-a-path)
- [MLflow get-artifacts server-side request forgery information disclosure](https://junglewise.ai/threats/cve-2026-118628-mlflow-get-artifacts-server-side-request-forgery-information)
- [MLflow SHAP load_explainer deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-118627-mlflow-shap-load-explainer-deserialization-of-untrusted-data)
- [MLflow Tracking Server missing authorization in get_endpoints](https://junglewise.ai/threats/cve-2026-118625-mlflow-tracking-server-missing-authorization-privilege)
- [MLflow Tracking Server authorization bypass in Jobs API](https://junglewise.ai/threats/cve-2026-118624-mlflow-tracking-server-jobs-missing-authorization-information)