Fix arbitrary file read via prompt tag validation bypass in Model Registry by TomeHirata · Pull Request #20833 · mlflow/mlflow

TomeHirata · 2026-02-16T05:02:20Z

Related Issues/PRs

Fixes #20818

What changes are proposed in this pull request?

See this ticket for the security vulnerability

How is this PR tested?

Existing unit/integration tests
New unit/integration tests
Manual tests

Does this PR require documentation update?

Does this PR require updating the MLflow Skills repository?

No. You can skip the rest of this section.
Yes. Please link the corresponding PR or explain how you plan to update it.

Release Notes

Is this a user-facing change?

No. You can skip the rest of this section.
Yes. Give a description of this change to be included in the release notes for MLflow users.

What component(s), interfaces, languages, and integrations does this PR affect?

Components

How should the PR be classified in the release notes? Choose one:

rn/none - No description will be included. The PR will be mentioned only by the PR number in the "Small Bugfixes and Documentation Updates" section
rn/breaking-change - The PR will be mentioned in the "Breaking Changes" section
rn/feature - A new user-facing feature worth mentioning in the release notes
rn/bug-fix - A user-facing bug fix worth mentioning in the release notes
rn/documentation - A user-facing documentation change worth mentioning in the release notes

Should this PR be included in the next patch release?

Yes should be selected for bug fixes, documentation updates, and other small changes. No should be selected for new features and larger changes. If you're unsure about the release classification of this PR, leave this unchecked to let the maintainers decide.

What is a minor/patch release?

Minor release: a release that increments the second part of the version number (e.g., 1.2.0 -> 1.3.0).
Bug fixes, doc updates and new features usually go into minor releases.
Patch release: a release that increments the third part of the version number (e.g., 1.2.0 -> 1.2.1).
Bug fixes and doc updates usually go into patch releases.

Yes (this PR will be cherry-picked and included in the next patch release)
No (this PR will be included in the next minor release)

…istry Reject local filesystem sources (file:// URIs and absolute paths) when creating model versions with the prompt tag, preventing attackers from using the prompt code path to bypass source validation and read arbitrary server files via the artifact download endpoint. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>

github-actions · 2026-02-16T05:02:35Z

🛠 DevTools 🛠

Install mlflow from this PR

# mlflow
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/20833/merge
# mlflow-skinny
pip install git+https://github.com/mlflow/mlflow.git@refs/pull/20833/merge#subdirectory=libs/skinny

For Databricks, use the following command:

%sh curl -LsSf https://raw.githubusercontent.com/mlflow/mlflow/HEAD/dev/install-skinny.sh | sh -s pull/20833/merge

Copilot

Pull request overview

This PR addresses a security issue in MLflow Model Registry where creating a prompt model version could bypass source validation, potentially enabling arbitrary local file reads via crafted source values.

Changes:

Add prompt-specific validation in CreateModelVersion to reject local filesystem sources and validate against relative-path traversal.
Add a unit test ensuring prompt model version creation rejects local source paths.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`mlflow/server/handlers.py`	Enforces non-local prompt sources and applies traversal validation for prompt model version creation.
`tests/server/test_handlers.py`	Adds coverage to ensure prompt model version creation rejects local filesystem `source` inputs.

mlflow/server/handlers.py

tests/server/test_handlers.py

github-actions · 2026-02-16T05:11:17Z

Documentation preview for f98f125 is available at:

https://pr-20833--mlflow-docs-preview.netlify.app/docs/latest/

More info

Ignore this comment if this PR does not change the documentation.
The preview is updated when a new commit is pushed to this PR.
This comment was created by this workflow run.
The documentation was built by this workflow run.

- Wrap is_local_uri() in try/except to normalize errors to INVALID_PARAMETER_VALUE (400) instead of INTERNAL_ERROR (500) for invalid prompt sources like file://remote-host/path - Add test cases for file://remote-host bypass attempts and encoded path traversal (..%2f) in non-local URIs 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>

The previous validation using is_local_uri() rejected schemeless sources like "prompt-template" and "dummy-source" that are used internally as placeholders for prompt model versions. Narrowed the check to only block file:// URIs and absolute paths, and only run traversal validation on sources with an actual URL scheme. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>

harupy · 2026-02-17T03:33:45Z

mlflow/server/handlers.py

+        parsed = urllib.parse.urlparse(source)
+        if parsed.scheme == "file" or (parsed.scheme == "" and source.startswith("/")):
+            raise MlflowException(
+                f"Invalid model version source: '{source}'. "


Suggested change

f"Invalid model version source: '{source}'. "

f"Invalid prompt source: '{source}'. "

can we replace model version with prompt?

harupy · 2026-02-17T03:35:46Z

tests/server/test_handlers.py

+    )
+    resp = _create_model_version()
+    assert resp.status_code == 400
+    data = json.loads(resp.get_data())


resp doesn't have a method to get dict?

harupy · 2026-02-17T03:36:03Z

tests/server/test_handlers.py

+    )
+    resp = _create_model_version()
+    assert resp.status_code == 400
+    data = json.loads(resp.get_data())


https://github.com/mlflow/mlflow/pull/20833/files#r2814827762

harupy

Left comments. LGTM once they are addressed!

- Use "Invalid prompt source" instead of "Invalid model version source" in the prompt-specific error message - Use resp.get_json() instead of json.loads(resp.get_data()) in tests 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>

…istry (mlflow#20833) Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com> Co-authored-by: Claude <noreply@anthropic.com>

…istry (#20833) Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com> Co-authored-by: Claude <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings February 16, 2026 05:02

TomeHirata added the team-review Trigger a team review request label Feb 16, 2026

github-actions bot added area/prompts MLflow Prompt Registry and Optimization rn/bug-fix Mention under Bug Fixes in Changelogs. v3.10.0 size/S Small PR (10-49 LoC) labels Feb 16, 2026

github-actions bot requested review from B-Step62 and daniellok-db February 16, 2026 05:02

TomeHirata mentioned this pull request Feb 16, 2026

[BUG] Security Vulnerability #20818

Closed

Copilot started reviewing on behalf of TomeHirata February 16, 2026 05:02 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

mlflow/server/handlers.py Outdated Show resolved Hide resolved

tests/server/test_handlers.py Show resolved Hide resolved

TomeHirata and others added 2 commits February 16, 2026 14:30

harupy reviewed Feb 17, 2026

View reviewed changes

harupy approved these changes Feb 17, 2026

View reviewed changes

github-actions bot assigned harupy Feb 17, 2026

TomeHirata enabled auto-merge February 17, 2026 06:02

TomeHirata added this pull request to the merge queue Feb 17, 2026

Merged via the queue into mlflow:master with commit 6e801f4 Feb 17, 2026
49 checks passed

TomeHirata deleted the fix/prompt-source-validation branch February 17, 2026 06:42

github-actions bot added size/M and removed size/S Small PR (10-49 LoC) labels Feb 17, 2026

daniellok-db pushed a commit that referenced this pull request Feb 20, 2026

Fix arbitrary file read via prompt tag validation bypass in Model Reg…

ff11222

…istry (#20833) Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com> Co-authored-by: Claude <noreply@anthropic.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix arbitrary file read via prompt tag validation bypass in Model Registry#20833

Fix arbitrary file read via prompt tag validation bypass in Model Registry#20833
TomeHirata merged 4 commits intomlflow:masterfrom
TomeHirata:fix/prompt-source-validation

TomeHirata commented Feb 16, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 16, 2026

Install mlflow from this PR

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Feb 16, 2026 •

edited

Loading

Uh oh!

harupy Feb 17, 2026 •

edited

Loading

Uh oh!

harupy Feb 17, 2026 •

edited

Loading

Uh oh!

harupy Feb 17, 2026

Uh oh!

harupy left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	f"Invalid model version source: '{source}'. "
	f"Invalid prompt source: '{source}'. "

Conversation

TomeHirata commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related Issues/PRs

What changes are proposed in this pull request?

How is this PR tested?

Does this PR require documentation update?

Does this PR require updating the MLflow Skills repository?

Release Notes

Is this a user-facing change?

What component(s), interfaces, languages, and integrations does this PR affect?

How should the PR be classified in the release notes? Choose one:

Should this PR be included in the next patch release?

Uh oh!

github-actions bot commented Feb 16, 2026

Install mlflow from this PR

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

harupy Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

harupy Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

harupy Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

harupy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

TomeHirata commented Feb 16, 2026 •

edited

Loading

github-actions bot commented Feb 16, 2026 •

edited

Loading

harupy Feb 17, 2026 •

edited

Loading

harupy Feb 17, 2026 •

edited

Loading