CVE-2026-116692
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously.
- mlflow mlflow
- Critical
- CVSS 9.8
- Fixed version listed
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| mlflow mlflow | >= 3.12.0rc0, < 3.17.0 | None listed |
Affected packages
| Package | Affected | Fixed in | Advisory |
|---|---|---|---|
| mlflow (PyPI) | >= 3.12.0rc0, < 3.17.0 | 3.17.0 | GHSA-26p8-2jq9-3vq9 |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1, scored by GitHub)
- Weakness
- CWE-94: Improper Control of Generation of Code ('Code Injection'); CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
- Vendor
- mlflow, mlflow
Timeline
- GitHub published advisory GHSA-26p8-2jq9-3vq9 (critical). Fixed in 3.17.0.
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.