MLflow tracking servers running without authentication or with basic authentication are vulnerable to an arbitrary file read vulnerability via crafted model versions tagged as prompts with schemeless local paths. This allows remote attackers to read arbitrary files on the server filesystem with the privileges of the MLflow server process. The vulnerability affects MLflow versions 3.10.0 through 3.16.1 and is fixed in version 3.17.0.