MLflow Vulnerability CVE-2026-116690 Exploited in the Wild as PoC Details Go Public

TL;DR

Previdian’s honeypot network has caught attackers targeting CVE-2026-116690, an MLflow vulnerability that lets unauthenticated users read files from the server. The attempts surfaced within a day of the CVE’s publication on October 27. MLflow’s GitHub advisories now publish full details and proof-of-concept code for this flaw. The same is true for a related critical RCE bug.

Attackers are already probing MLflow servers for CVE-2026-116690 (CVSS 7.5), an arbitrary file read flaw. A second bug, CVE-2026-116692 (CVSS 9.8), allows unauthenticated remote code execution, and its advisory also ships a working PoC. MLflow 3.17.0 fixes both, so upgrade now.

Why It Matters

MLflow is an open-source platform for tracking machine learning experiments and models. By default, the mlflow server command runs without authentication. As a result, an exposed tracking server is open to anyone who can reach its port.

Previdian reported that over the past 24 hours its honeypots “captured exploitation attempts targeting four recently disclosed vulnerabilities.” The first on its list is the MLflow file read flaw, which “can expose sensitive files accessible to the MLflow server process.”

This is not the first MLflow vulnerability to draw attackers. CISA added an MLflow server-side request forgery bug, CVE-2026-64849, to its Known Exploited Vulnerabilities catalog on August 19. Neither of the new flaws is in that catalog yet.

How the Attack Works

CVE-2026-116690: Arbitrary file read

This bug sits in how MLflow handles prompt model versions. An earlier fix for CVE-2026-2614 blocked absolute paths and file URIs. However, the advisory explains that it “runs path validation only when the source carries a URL scheme.”

Consequently, an attacker can store a relative path as a prompt’s source. MLflow’s artifact download feature then serves files from that location. The advisory lists confirmed targets such as /etc/passwd and SQLite tracking databases.

Basic-auth servers are not safe either. According to the advisory, “a low-privilege account can use this to read the authentication database, including the admin password hash.”

CVE-2026-116692: Remote code execution

The critical bug lives in third-party scorer support, which arrived in MLflow 3.12.0. The server imports a Python module named in the request. It only checks that the name starts with one of four allowed package prefixes. The advisory warns that “a package-name prefix is not a provenance boundary.”

In short, an attacker can use MLflow’s own artifact upload feature to place a module under an allowed path. A follow-up request then makes the server import and run it. On the official v3.14.0 Docker image, the reporter’s proof ran “as root.”

Notably, Previdian’s report names only the file read flaw from these two advisories. So far, no source confirms in-the-wild attacks on CVE-2026-116692.

Affected Versions

Both advisories include their reporters’ proof-of-concept scripts, which makes this MLflow vulnerability pair easy to test and to abuse.

• CVE-2026-116690: MLflow 3.10.0 through 3.16.1
• CVE-2026-116692: MLflow 3.12.0 through 3.16.x

Patch and Mitigation

Upgrade to MLflow 3.17.0, which PyPI received on October 7. The fix for the file read flaw “accepts only MLflow’s own placeholder sources for prompt versions.” Both advisories went public in mid-October, while the CVE records followed on October 27.

In addition, take these steps:

• Never expose an unauthenticated MLflow server to the internet.
• Enable authentication and limit who can create experiments and models.
• Run MLflow as a non-root user with a read-only package directory, which blocks the RCE chain.
• Rotate credentials and keys stored on any server that faced the internet.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.