CVE-2026-116690

### Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the `CreateModelVersion` handler that rejects `file://` URIs and absolute paths but runs path validation only when the source carries a URL scheme. A schemeless value such as `../../etc`, a plain relative name, `.`, a percent-encoded path, or a Windows drive-letter path is therefore stored unchanged as the model version’s artifact location, and the `model-versions/get-artifact endpoint` later serves files from it with the privileges of the server process. The tag check also keyed on the presence of the `mlflow.prompt.is_prompt` tag rather than its value, so a false value still selected the weaker branch. Servers using `--app-name basic-auth` are also affected: any authenticated user can create a registered model, so a low-privilege account can use this to read the authentication database, including the admin password hash. Affected: MLflow 3.10.0 through 3.16.1. Fixed in 3.17.0 by [mlflow/mlflow#25870](https://github.com/mlflow/mlflow/pull/25870), which accepts only MLflow’s own placeholder sources for prompt versions and requires the prompt tag to be `true`. ### Details When creating a model version with the `mlflow.prompt.is_prompt` tag set to true, the request is handled by the prompt branch in `_create_model_version()`. `mlflow/server/handlers.py:2674-2690`: ```python is_prompt = _is_prompt_request(request_message) if is_prompt: source = request_message.source parsed = urllib.parse.urlparse(source) if parsed.scheme == "file" or (parsed.scheme == "" and source.startswith("/")): raise MlflowException(...) if parsed.scheme: _validate_non_local_source_contains_relative_paths(source) else: if