Overview
CVE-2026-116692 is a critical (CVSS 9.8) remote code execution vulnerability in MLflow, the open source platform for managing ML models, LLMs, and agents. It was published on October 27, 2026 (GitHub advisory GHSA-26p8-2jq9-3vq9).
Technical Details
Third-party scorer deserialization in mlflow/genai/scorers/base.py accepts any request-selected descendant of THIRD_PARTY_SCORER_ALLOWED_MODULES instead of requiring an exact allowed module. In effect, the check is a package-prefix match rather than an exact match (CWE-502).
Reported attack flow:
- The caller sets an arbitrary local
file://URI as an experiment'sartifact_location. - The caller uploads a Python file as a run artifact into an allowed scorer package directory.
- The caller POSTs to
/ajax-api/3.0/mlflow/scorer/invoke.Scorer.model_validate_json()imports the module and constructs the class before any trace processing, executing the attacker's code.
Prerequisites
| Deployment | Requirement |
|---|---|
| Authentication disabled | No credentials needed |
| Basic auth enabled | A principal able to create experiments and runs and upload artifacts |
| Both | The server process must be able to write to the allowed scorer package |
The official MLflow Docker images run as root by default, which satisfies the write requirement. At the time of writing, VulDB reports no public exploit; a GitHub repository tied to the CVE is a detection-only scanner that checks the server version.
Affected Versions
MLflow 3.12.0rc0 up to, but not including, 3.17.0.
Remediation
- Upgrade to MLflow 3.17.0, which matches modules verbatim against a closed allowlist rather than by package prefix.
- Run MLflow containers as a non-root user with a read-only root filesystem.
- Do not expose the tracking server to untrusted networks; enable authentication and restrict who can create experiments and upload artifacts.
- Review experiments for unexpected
file://artifact locations and unexpected Python files in scorer package directories.