An MLflow model version source supplied as a relative path without a URI scheme could bypass prompt-source filtering and resolve a file on the server. A caller able to use the affected model-version artifact retrieval path must control its source metadata or trigger use of a crafted version. The advisory demonstrates a local-file disclosure route under…
Inspect the ClaimsCase · DiggingBeagle record
MLflow prompt model-source paths could read server-local artifacts
An MLflow model version source supplied as a relative path without a URI scheme could bypass prompt-source filtering and resolve a file on the server. The advisory demonstrates a local-file disclosure route under MLflow service privileges, potentially including authentication material if reachable.
Scope
A caller able to use the affected model-version artifact retrieval path must control its source metadata or trigger use of a crafted version. No real customer file theft is established; this is CVE-2026-116690, not the separate scorer-import execution bug.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: A path is not a safe artifact identifier merely because it lacks a URI scheme.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-MLFLOW-PROMPT-PATH-1 · CLM-ENRICH-20261029-14 · MLflow model prompt-source traversal, GHSA-m65p-9j7q-6w33
At a glance
The advisory demonstrates a local-file disclosure route under MLflow service privileges, potentially including authentication material if reachable.
Read the implicationsNo real customer file theft is established; this is CVE-2026-116690, not the separate scorer-import execution bug.
Limits and uncertaintyFull account
An MLflow model version source supplied as a relative path without a URI scheme could bypass prompt-source filtering and resolve a file on the server.
A caller able to use the affected model-version artifact retrieval path must control its source metadata or trigger use of a crafted version. The advisory demonstrates a local-file disclosure route under MLflow service privileges, potentially including authentication material if reachable.
No real customer file theft is established; this is CVE-2026-116690, not the separate scorer-import execution bug. Use MLflow 3.17.0 and authorize the canonical resolved artifact source, including source scheme and trustworthy metadata values.
Evidence interpretation and control boundary. A path is not a safe artifact identifier merely because it lacks a URI scheme. The affected prompt-version route resolved a relative source in server-local filesystem context and treated the presence of a metadata tag as enough to choose a weaker validation path. Unlike the scorer import bug, this mechanism concerns reading local content, and the disclosed scope depends on MLflow service filesystem permissions.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-14The MLflow prompt-version advisory identifies relative model-source paths and a tag-presence condition that can lead to server-local artifact retrieval; 3.17.0 is the listed fixed version.supported
Basis: reported finding
- supportsMLflow model prompt-source traversal, GHSA-m65p-9j7q-6w33primary disclosure
GHSA-m65p-9j7q-6w33: source URL validation, model version tag bypass, affected versions
CLM-CP23-MLFLOW-PROMPT-PATH-1An MLflow model version source supplied as a relative path without a URI scheme could bypass prompt-source filtering and resolve a file on the server. A caller able to use the affected model-version artifact retrieval path must control its source metadata or trigger use of a crafted version. The advisory demonstrates a local-file disclosure route under MLflow service privileges, potentially including authentication material if reachable.supported
Basis: reported finding
- supportsMLflow model prompt-source traversal, GHSA-m65p-9j7q-6w33primary disclosure
GHSA-m65p-9j7q-6w33: source URL validation, model version tag bypass, affected versions
Implications
The advisory demonstrates a local-file disclosure route under MLflow service privileges, potentially including authentication material if reachable.
Controls and mitigations
- Use MLflow 3.17.0 and authorize the canonical resolved artifact source, including source scheme and trustworthy metadata values.
Unknowns and contradictions
- No real customer file theft is established; this is CVE-2026-116690, not the separate scorer-import execution bug.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202