EUVD-2026-111383
GHSA-26p8-2jq9-3vq9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MLflow tracking server over network
-
DeliveryCreate experiment with file:// artifact root under allowed scorer package
-
ExploitUpload malicious Python module as run artifact
-
ExecutionInvoke scorer endpoint to import module
-
ImpactConstructor runs, achieving code execution as server process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The allowed third-party scorer package directory (e.g. mlflow/genai/scorers/trulens under site-packages) must be writable by the MLflow server process - this holds in the official v3.14.0 image, which runs as uid 0 with a writable installed package tree, and may hold in virtualenvs installed and run by the same OS user. On authentication-disabled deployments (the default) no credentials are required. On basic-auth deployments the caller must be an authenticated principal able to create an experiment and run and upload artifacts, because the scorer-invoke endpoint uses validate_gateway_proxy and performs no experiment/scorer-level resource permission check. Affected versions are MLflow >= 3.12.0rc0 and < 3.17.0 (the feature is absent in 3.11.1). Exploitation is blocked by a read-only container filesystem or a scorer package directory owned by a different, non-writable user. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated one. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) aligns with the mechanism described: the GHSA advisory demonstrates unauthenticated remote Python code execution against the default no-auth MLflow server using the official v3.14.0 image, with the process running as uid 0. The vuln.today decision label is 'act_now' and a vendor patch (3.17.0) is available, reinforcing urgency. The one nuance is that PR:N is only accurate for authentication-disabled deployments; for basic-auth deployments the attacker must be an authenticated principal able to create an experiment/run and upload artifacts, so PR would effectively be PR:L there - the single 9.8 score blends two deployment modes. Additionally, the whole chain depends on an environmental precondition - the allowed scorer package directory must be writable by the server process - which the CVSS vector does not capture; this holds by default in the official image but is blocked by a read-only filesystem or a package tree owned by a non-writable user. No EPSS score and no CISA KEV entry are present in the input, so widespread automated exploitation cannot be confirmed from the data; however, a reporter-executed proof of concept is attached to the advisory. On balance: default-configuration internet- or network-reachable MLflow tracking servers below 3.17.0 are at serious, realistic risk and should be patched immediately. |
| Exploit ScenarioDerived | An attacker with network reach to an MLflow tracking server (default no-auth configuration) creates an experiment whose file:// artifact location points beneath one of the allow-listed third-party scorer packages, creates a run, and uploads a malicious Python module as a run artifact. They then submit a serialized third-party scorer referencing that uploaded module via /ajax-api/3.0/mlflow/scorer/invoke, causing the server to import the module and run the attacker's constructor as the server process (uid 0 in the official image) before any trace processing. A reporter-executed proof of concept (new_remote_poc.py) is attached to the GHSA advisory and demonstrated code execution (PROOF_MATCH=1), though it is not independently verified here as weaponized exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking server place a Python module under an allow-listed third-party scorer package and have the server import and instantiate it via the scorer invoke endpoint, executing arbitrary code in the MLflow server process. The flaw is a prefix-matching mistake in the third-party scorer allow-list combined with MLflow's own experiment, run and artifact-upload endpoints, which can be used to publish a module inside a writable scorer package directory; the shipped v3.14.0 container image, running as uid 0 with a writable site-packages tree, is fully exploitable without credentials, while basic-auth deployments require a principal able to create an experiment and run and upload artifacts (the invoke endpoint is gated only by validate_gateway_proxy, with no experiment- or scorer-level permission check). A public proof-of-concept script and a working reproduction accompany the GitHub advisory, and the vendor fixed the issue in 3.17.0.
RemediationAI
Vendor-released patch: MLflow 3.17.0. Upgrade to 3.17.0 or later (release tag https://github.com/mlflow/mlflow/releases/tag/v3.17.0); the fix lands via PR https://github.com/mlflow/mlflow/pull/25906 and commit https://github.com/mlflow/mlflow/commit/a732443e695c3c677680c54320efc394c81654ab, and enforces exact-module allow-listing, identifier-only metric_name, no metric_name kwargs override, and a Scorer-subclass check. If upgrading immediately is not possible, the documented compensating controls are: run the MLflow server from a read-only container filesystem, and/or run it as an operating-system user that does not own and cannot write to the installed scorer package directories (for example mlflow/genai/scorers/trulens under site-packages) - either condition blocks the artifact-placement chain, at the cost of losing the ability to install packages or write files in that tree at runtime. Enabling MLflow basic authentication only raises the bar: the scorer-invoke AJAX endpoint is bound to validate_gateway_proxy and performs no experiment- or scorer-level permission check, so any authenticated principal that can create an experiment and run and upload artifacts can still exploit the flaw. Note also that the stock official image runs as uid 0 with a writable package tree, so simply using the vendor image without one of the above controls does not mitigate the issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MLflow 3.12.0 introduced registration and deserialization of third-party scorers. In mlflow/genai/scorers/scorer_utils.py the constant THIRD_PARTY_SCORER_ALLOWED_MODULES lists four package roots (mlflow.genai.scorers.ragas, .deepeval, .trulens, .phoenix), and in mlflow/genai/scorers/base.py the deserializer accepted either an exact root or any dotted descendant via 'module_path == m or module_path.startswith(m + ".")', then called importlib.import_module(module_path), getattr(module, class_name) and scorer_class(**init_kwargs). Because a package prefix is not a provenance boundary, a file planted below an allowed package satisfies the string check and is imported as mlflow.genai.scorers.<pkg>.<run_id>.artifacts.<module> - the classic CWE-94 code-injection outcome, with CWE-470 unsafe reflection as the secondary classification. The handler _invoke_scorer_handler() at /ajax-api/3.0/mlflow/scorer/invoke calls Scorer.model_validate_json(serialized_scorer) before get_trace_batches_for_scorer(), so the attacker-controlled constructor runs before any trace-ID validation (the reproduced attempt ends in an HTTP 500 after the marker file was already written). Placement is made trivial by MLflow's file-backed artifact layout: an experiment created with artifact_location file:///usr/local/lib/python3.10/site-packages/mlflow/genai/scorers/trulens causes each run to write into <artifact_location>/<run_id>/artifacts/. The 3.17.0 fix (PR #25906, commit a732443e) switches to verbatim module matching, requires metric_name to be a plain identifier (closing the RagasScorer/DeepEvalScorer metric-name splicing route), rejects a metric_name kwarg override, and requires the resolved class to be an actual Scorer subclass.
Know when Mlflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Default no-auth servers allow network, unauthenticated, no-interaction code execution as the server process with full C/I/A impact; the writable-package precondition is met by default in the official image, so AC:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.
Articles & Coverage 1
Technical POC Analysis
CWE-94 code injection, with CWE-470 unsafe reflection as a secondary weakness, in MLflow third-party scorer deserialization.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical vulnerability (CVE-2026-116692) in MLflow versions 3.12.0rc0 through 3.16.x allows unauthenticated attackers to execute arbitrary code on the MLflow tracking server, potentially leading to full system compromise. The flaw is especially dangerous for organizations using the default container image (v3.14.0) running as root, as any network attacker can exploit it without credentials, putting sensitive ML data and infrastructure at risk. Leadership should prioritize immediate patching to prevent data breaches or service disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. Rated critical severity (CVSS 9.6), t
Exploit-DB