A flaw in the _create_model_version() handler of the mlflow server allows an unauthenticated remote attacker to read any file on the server. By including the tag mlflow.prompt.is_prompt in a CreateModelVersion request, the server stores a local filesystem path as the model source. Later, the get_model_version_artifact_handler() serves files from this unverified path, exposing arbitrary file contents and defeating confidentiality.

This vulnerability affects mlflow versions 3.9.0 and earlier. The issue is fixed in 3.10.0 and later releases. Any deployment of the affected versions is potentially vulnerable.

The CVSS score of 7.5 indicates significant risk. No EPSS data is available, but the vulnerability is driverless and can be exploited by any actor able to send HTTP requests to the mlflow API. The issue is not listed in the CISA KEV catalog, yet the remote, unauthenticated nature of the attack and the direct reading of server files make it a strong candidate for active exploitation. The attack vector is inferred to rely on crafting a model creation request that bypasses source validation through the prompt tag, allowing direct file read without further authentication.