Vulnerability · CVE-2026-116692
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
Published Oct 27, 2026 · catalog updated Oct 27, 2026 · MLflow vulnerable to remote
Last checked Nov 6, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-116692. EPSS is 0.70%. Act only if a listed version of MLflow vulnerable to remote is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (MLflow vulnerable to remote).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Critical9.8
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.70%
- Remediation
- Version ranges on file
- Affected products
- PyPI mlflow · pip mlflow · pypi mlflow
## Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously. An HTTP caller can combine this behavior with MLflow's built-in experiment, run, and artifact-upload endpoints: 1. Create an experiment whose local artifact location points to a writable allowed scorer package. 2. Create a run, causing MLflow to allocate . 3. Upload a Python module into that run artifact directory. 4. Submit a serialized third-party scorer whose module path resolves to the uploaded file. 5. Trigger server-side import and class construction through . On the default no-auth server using the official MLflow v3.14.0 image, this produces unauthenticated arbitrary Python code execution with the privileges of the MLflow server process. The reproduced image runs the process as uid 0 and permits writes to its installed Python package tree. The attached proof of concept is intentionally harmless. The uploaded constructor performs one action only: it writes a random marker beside its own uploaded run artifact. The marker is then downloaded through MLflow's run-artifact endpoint and checked for an exact match. ## Technical details ### 1. The allow-list accepts attacker-created descendants At release commit , defines these allowed roots: In , the deserializer accepts either an exact root or any descendant: It then performs the following operations using request-controlled values: A package-name prefix is not a provenance boundary. If the server process can write below an allowed package, an attacker-created descendant can satisfy the string-prefix check and become importable Python code. Relevant source locations at the v3.14.0 release commit: * , allowed third-party scorer modules * , third-party scorer deserialization and
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- PyPI mlflow3.12.0rc0 → 3.17.0
- pip mlflow>= 3.12.0rc0, < 3.17.0
- pypi mlflow>=3.12.0-rc.0,<3.17.0
How to fix CVE-2026-116692
Upgrade
CVE-2026-116692 lists a fix boundary at 3.17.0. Compare the installed build with that boundary before you change production.
Version check
Affected < 3.17.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-116692. EPSS is 0.70%. Act only if a listed version of MLflow vulnerable to remote is installed.
Which versions are affected?
Compare what you have installed with 3.12.0rc0 → 3.17.0, >= 3.12.0rc0, < 3.17.0, >=3.12.0-rc.0,<3.17.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-470; CWE-94: Code Injection. EPSS 0.70%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 27, 2026 · GitHub Advisory Database
Detected
## Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously. An HTTP caller can combine this behavior with MLflow's b
Oct 27, 2026 · GitHub Advisory Database
Fix available
mlflow fixed in 3.17.0
Oct 27, 2026 · GitHub Advisory Database
Fix available
mlflow fixed in 3.17.0
Oct 27, 2026 · GitHub Advisory Database
Updated
## Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously. An HTTP caller can combine this behavior with MLflow's b
Sources
- CVE.orgVulnerability recordCVE-2026-116692
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-116692
30-day exploitation probability 0.70%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-26p8-2jq9-3vq9
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-116692
MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously. An HTTP caller can combine this behavior with MLflow's built-in exp
advisories.gitlab.com - GitLab Advisory DatabasePackage advisorypypi/mlflow/CVE-2026-116692.yml
MLflow 3.12.0 introduced registration and deserialization support for + third-party scorers in OSS MLflow. During scorer deserialization, the server accepts + a request-controlled Python module path beneath one of four allowed package prefixes, + imports that module, obtains a request-controlled class, and instantiates it synchronously.\n\nAn + HTTP caller can combine this behavior with MLflow's b
gitlab.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-26p8-2jq9-3vq9
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
osv.dev - PyPA Advisory DatabasePackage advisoryGHSA-26p8-2jq9-3vq9
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
osv.dev
References
Freshness
Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 6, 2026
- GitHub Advisory DatabaseOct 28, 2026
- OpenSSF OSV / OSV ScannerOct 28, 2026
- CVE.orgOct 28, 2026
- PyPA Advisory DatabaseOct 28, 2026
- GitLab Advisory DatabaseOct 28, 2026
- GitLab Advisory DatabaseOct 28, 2026