MLflow CVE-2026-118627

Exploitation requires the victim to load an attacker-controlled SHAP explainer model through MLflow's SHAP load_explainer code path; the attacker must first deliver that malicious serialized model and induce the user to open the file or visit a malicious page (UI:R). The flaw is reachable by an unauthenticated attacker in the sense that no privileges are needed on the target (PR:N), but it is NOT remotely triggerable without local user action - the vector is local (AV:L), so exploitation is limited to contexts where a user actively loads untrusted explainer models, and code executes only with that user's privileges (scope unchanged, no privilege escalation described). The precise serialization format and whether loading is gated by any opt-in flag are not described in the available sources.

This is a CWE-502 deserialization-to-RCE flaw in MLflow's SHAP explainer loading (load_explainer), carrying a CVSS 3.0 base score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vector is the key signal: despite the 'Remote Code Execution' and 'remote attackers' language in the description, the attack vector is LOCAL (AV:L) and requires user interaction (UI:R) - the victim must open a malicious model file or visit a malicious page, and code runs only in the context of the current user, not as a server or root. This is therefore not a remote, unauthenticated, server-side pre-auth RCE; it is a client/operator-side code-execution bug triggered by loading attacker-supplied content. No EPSS score, CISA KEV listing, or confirmed public exploit was provided in the input, so there is no evidence of active exploitation or weaponization. The only intelligence signal of urgency is the vuln.today 'this_week' decision label and the fact that it was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-30301, advisory ZDI-26-843), indicating a vendor-coordinated, credible disclosure rather than observed in-the-wild activity. Net assessment: a genuinely serious bug (full C/I/A impact, low complexity, no privileges needed) but gated by user interaction and local vector, so it ranks as an important patch-this-week item rather than a drop-everything emergency - EPSS and KEV are absent, which is consistent with no known widespread exploitation.

An attacker crafts a malicious serialized SHAP explainer model and distributes it (e.g., via a model registry, shared artifact, email attachment, or a web page) so that a data scientist or ML engineer loads it with MLflow's load_explainer. Because the loader deserializes untrusted data without validation, opening the crafted model executes the attacker's code with the privileges of the user running MLflow. No public exploit was identified in the provided data, though a ZDI advisory reference exists.