CVE-2026-2614

high

Published 2026-05-11 · Modified 2026-05-18

CVSS v3

7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2

—

VIR risk

7.5

Description

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

Exploit likelihood

83%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

vendor Authored 2026-05-27

Vendor advisory: security@huntr.dev — https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a

Ecosystem	Package	Vulnerable	Fixed
PyPI	mlflow	`<3.10.0`	`3.10.0`
PIP	mlflow	`< 3.10.0`	`3.10.0`

Vendor	Product	Versions	Fixed
lfprojects	mlflow	`{"endExcluding":"3.10.0"}`	`3.10.0`

CWE-22

Verify integrity in audit chain (admin only). AS-IS.