CVE-2026-116692 · GHSA-26p8-2jq9-3vq9
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- Risk score
- 74/100
- CVSS
- 9.8 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- MLflow is vulnerable to remote code execution on unauthenticated servers due to third-party scorer deserialization. An attacker can execute code without credentials, or with basic-auth credentials if they can create an experiment and run and upload artifacts.
- Affected
- {'products': ['MLflow'], 'packages': [{'ecosystem': 'pip', 'name': 'mlflow', 'vulnerable': '>= 3.12.0rc0, < 3.17.0'}]}
- Fix
- Upgrade to version 3.17.0 or later
- Exploitation
- Public proof of concept
Story map
At a glance
mlflow: Amber, patch this week. MLflow is vulnerable to remote code execution on unauthenticated servers due to third-party scorer deserialization. An attacker can execute code without credentials, or with basic-auth credentials if they can create an experiment and run and upload artifacts.
The flaws
- CVE-2026-116692: MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules (CVSS 9.8)
- CVE-2026-53995: MLflow FileStore trace IDs allow path traversal and arbitrary file writes (CVSS 8.2 · EPSS 1%)
- CVE-2026-116690: MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source (CVSS 7.5)
- CVE-2026-115886: MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints (CVSS 6.5 · EPSS 0%)
The fix
Upgrade mlflow: 3.17.0 or later on your release line
Who is exposed: {'products': ['MLflow'], 'packages': [{'ecosystem': 'pip', 'name': 'mlflow', 'vulnerable': '>= 3.12.0rc0, < 3.17.0'}]}
Where it stands
- Public proof of concept
Connects to
- Same weakness: Code injection (CWE-94). 250 other warnings in 30 days
Why it is Amber
- CVSS 9.8 critical
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| mlflow | pip | >= 3.12.0rc0, < 3.17.0 | 3.17.0 |
References
- https://github.com/advisories/GHSA-26p8-2jq9-3vq9
- https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9
- https://github.com/mlflow/mlflow/pull/25906
- https://github.com/mlflow/mlflow/commit/a732443e695c3c677680c54320efc394c81654ab
- https://github.com/mlflow/mlflow/releases/tag/v3.17.0
- https://github.com/advisories/GHSA-26p8-2jq9-3vq9
Original description
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.
Last activity 27 Oct 2026. Patch Forecast updates every hour.