CVE-2026-115886

MLflow optional scorers can issue attacker-directed requests

MLflow project · MLflow GenAI scorer endpoints

First documented disclosure · Review checkpoint

Summary

An attacker could select third-party scorer parameters that make the tracking server send an outbound request to an unintended host.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Scorer deserialization constrained module paths but not the selected class or constructor arguments.

Conditions required

A reachable unauthenticated server with optional trulens and trulens-providers-litellm installed.

Potential impact

Server-side requests carrying attacker-controlled headers and body, potentially reaching internal services.

Affected versions and configurations

3.12.0rc0 through versions before 3.17.0.

Fix and mitigation status

3.17.0.

Practical next steps

Upgrade, require authentication and limit optional integrations and egress destinations.

Operating lesson

Allowlisting a module does not make all of its constructors or arguments safe.

Evidence and limits

October 22 is upstream publication; October 23 is the CVE record. The demonstration used an attacker-owned canary token, not a stolen server credential.

Sources