Read the docs
TI-2026-79999 Aliases CVE-2026-115886GHSA-2wqp-q3c6-ccj5

Server-side request forgery in MLflow scorer endpoints

Priority HIGH 68CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

MLflow from 3.12.0rc0 before 3.17.0 deserializes third-party scorer data sent to its scorer invoke, register, and GenAI evaluate endpoints without constraining the selected class. With the optional trulens and trulens-providers-litellm packages installed, an unauthenticated remote attacker can point the LiteLLM fallback at an attacker-chosen or internal host, sending attacker-controlled headers and body (CWE-918).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission. This issue is fixed in version 3.17.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00676 52nd percentileScored 2026-11-07
Fix Partial mlflow (mlflow): 3.17.0mlflow (PyPI): 3.17.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowmlflow3.12.0rc0 to before 3.17.03.17.0Patch availableCNA
—mlflow (PyPI)3.12.0rc0 to before 3.17.03.17.0Patch availableGHSA-2wqp-q3c6-ccj5
  • mlflow VendorMLflow Affected 3.12.0rc0 to before 3.17.0 Fixed in 3.17.0 Patch available CNA
  • mlflow (PyPI) Vendor— Affected 3.12.0rc0 to before 3.17.0 Fixed in 3.17.0 Patch available GHSA-2wqp-q3c6-ccj5

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*——MLflow
  • cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* Versions — — ·MLflow

Remediation

Upgrade the PyPI mlflow package to 3.17.0, which fixes this issue. Red Hat OpenShift AI (RHOAI) is affected without a fix, and Red Hat lists its plan as none available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA mlflow (mlflow) Fixed in 3.17.0
  • Fix · GHSA-2wqp-q3c6-ccj5 mlflow (PyPI) Fixed in 3.17.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-115886
  2. 2026-10-23 Alias added: GHSA-2wqp-q3c6-ccj5
  3. 2026-10-23 Fix available: PyPI/[email protected] · GHSA-2wqp-q3c6-ccj5
  4. 2026-10-23 CVSS score added · GHSA-2wqp-q3c6-ccj5
  5. 2026-10-23 Weakness changed · GHSA-2wqp-q3c6-ccj5
  6. 2026-10-23 5 new references · GHSA-2wqp-q3c6-ccj5
  7. 2026-10-24 Priority changed: MEDIUM → LOW
  8. 2026-10-24 Affected versions changed · Red Hat
  9. 2026-10-24 CVSS score added · Red Hat
  10. 2026-10-29 EPSS moved to the 50th–90th percentile
  11. 2026-10-29 CISA SSVC decision points changed
  12. 2026-10-29 Priority changed: LOW → HIGH

References

Other 5

  • TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
  • TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
  • TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
  • TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
  • TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
See all 175 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences