SeldonIO MLServer CVE-2026-109156

Requires that MLServer's environment_tarball feature is in use - i.e., a model configured to load a custom packed environment that _extract_env unpacks - and that the attacker can supply or influence the tarball's contents with malicious '../' tar entries. Limiting factors: exploitation depends on the ability to deliver a crafted archive to the extraction routine (in many deployments this means some level of model-artifact/upload access rather than truly anonymous access, despite the PR:N claim), the vector's UI:P indicates the extraction must be triggered, and only versions up to and including 1.6.1 are affected. No vendor-confirmed patch exists because SeldonIO did not respond to disclosure.

This is a single-source (VulDB) path traversal (CWE-22) in MLServer's environment_tarball extraction, rated CVSS 4.0 base 5.3 (medium). The supplied vector (AV:N/AC:L/AT:N/PR:N/UI:P) implies network reach with no privileges but requires passive user interaction, and all impacts are Low (VC:L/VI:L/VA:L). Several escalation signals are ABSENT, not merely low: no EPSS score was provided (cannot gauge exploitation probability), the CVE is not in CISA KEV, and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' Exploitation status is therefore unexploited per available data, and the E:X in the vector means exploit maturity was explicitly not assessed. One notable tension: the vector asserts PR:N (unauthenticated), but the vulnerable path - supplying a conda environment tarball that _extract_env unpacks - realistically requires the ability to push a model/environment artifact to the server, which is typically a privileged or operator action in most deployments; verify exposure against your actual deployment topology. Net: a genuine but moderate-priority write-primitive flaw, not a drop-everything issue, weakened further by single-source reporting and an unresponsive vendor with no confirmed patch.

An attacker able to submit a model environment tarball to MLServer crafts an archive containing entries with '../' path sequences; when the server's _extract_env unpacks it, files are written outside the intended extraction directory, allowing overwrite or planting of files on the host. No public exploit code is known to exist at time of analysis. The network attack vector combined with low complexity makes triggering trivial once tarball submission is possible.