Read the docs
TI-2026-81527 Aliases CVE-2026-116692GHSA-26p8-2jq9-3vq9

Code execution via scorer deserialization in MLflow servers

Priority HIGH 82CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

MLflow from 3.12.0rc0 before 3.17.0 accepts scorer modules that descend from allowed packages during deserialization (CWE-470). On deployments with authentication disabled, an unauthenticated remote attacker can place a Python module in a writable allowed package and have the server import it, executing code. Basic-auth deployments require a principal that can create experiments, runs and upload artifacts.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00704 53rd percentileScored 2026-11-07
Fix Partial mlflow (mlflow): 3.17.0mlflow (PyPI): 3.17.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowmlflow3.12.0rc0 to before 3.17.03.17.0Patch availableCNA
—mlflow (PyPI)3.12.0rc0 to before 3.17.03.17.0Patch availableGHSA-26p8-2jq9-3vq9
  • mlflow VendorMLflow Affected 3.12.0rc0 to before 3.17.0 Fixed in 3.17.0 Patch available CNA
  • mlflow (PyPI) Vendor— Affected 3.12.0rc0 to before 3.17.0 Fixed in 3.17.0 Patch available GHSA-26p8-2jq9-3vq9

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*——MLflow
  • cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* Versions — — ·MLflow

Remediation

Upgrade MLflow to 3.17.0, the fixed version. Red Hat lists Red Hat OpenShift AI (RHOAI) as affected without a fix and with no plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA mlflow (mlflow) Fixed in 3.17.0
  • Fix · GHSA-26p8-2jq9-3vq9 mlflow (PyPI) Fixed in 3.17.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-116692
  2. 2026-10-27 Alias added: GHSA-26p8-2jq9-3vq9
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: MEDIUM → HIGH
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Other 5

  • TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
  • TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
  • TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
  • TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-05540 MLflow Authentication Bypass CVSS 3.1CRITICAL 9.8
See all 175 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences