CVE-2026-2614Proof of concept (PoC) published · CISASuited to automated attack · CISA
Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow
CVSS score
7.5
EPSS probability
%3.2
Risk score
0.2
Published
5 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Nuclei: MLflow <= 3.9.0 - Arbitrary File Read
Makefile Go / Python
Similar Vulnerabilities
9.3
CVE-2026-64849 Actively exploited
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
M
Patch verified Public Exploits:1EPSS %10
8.8
CVE-2025-68143
Path traversal in Lfprojects Model Context Protocol Servers
L
Patch verifiedEPSS %8
9.1
CVE-2025-68145
Path traversal in Lfprojects Model Context Protocol Servers
L
Patch status unknownEPSS %7
9.1
CVE-2026-0545
Missing Authentication for Critical Function in mlflow/mlflow
M
Patch status unknown Public Exploits:1EPSS %4
10.0
CVE-2025-15379
Command injection in Lfprojects Mlflow
L
Patch verified Public Exploits:1EPSS %2
8.8
CVE-2025-14287
Code injection in Lfprojects Mlflow
L
Patch status unknown Public Exploits:1EPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-2614"