What happened
The prompt branch of _create_model_version() accepts schemeless relative sources because path validation runs only when the source carries a URL scheme, and mlflow.prompt.is_prompt is inferred from tag presence rather than a true value. This allows a remote caller to register an arbitrary server-local path as the model artifact location and read it back. CISA SSVC classifies it as automatable with partial technical impact.
Why it matters
An unauthenticated attacker can read arbitrary files readable by the MLflow server process (tokens, .env, model artifacts, other tenants' data) on default deployments, feeding credential theft and further lateral movement inside the ML platform.
Attack vector
A remote caller stores a server-local path as a model-version artifact location (path validation only runs when a source has a URL scheme) and reads it back via /api/2.0/mlflow/model-versions/get-artifact, exposing files accessible to the MLflow server process.
Affected systems
MLflow >= 3.10.0, < 3.17.0
Mitigation
Upgrade to MLflow 3.17.0 (GHSA-m65p-9j7q-6w33). Restrict unauthenticated model-registry access.