A flaw in the _create_model_version() handler of the mlflow server allows an unauthenticated remote attacker to read any file on the server. By including the tag mlflow.prompt.is_prompt in a CreateModelVersion request, the server stores a local filesystem path as the model source. Later, the get_model_version_artifact_handler() serves files from this unverified path, exposing arbitrary file contents and defeating confidentiality.

This vulnerability affects mlflow versions 3.9.0 and earlier. The issue is fixed in 3.10.0 and later releases. Any deployment of the affected versions is potentially vulnerable.

The CVSS score of 7.5 indicates significant risk, while the EPSS score of 2% shows a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The remote, unauthenticated nature of the attack and the direct reading of server files make it a strong candidate for active exploitation. The attack vector relies on an attacker crafting a CreateModelVersion request that includes the mlflow.prompt.is_prompt tag to bypass source validation, allowing direct file read without further authentication.