CVE-2026-116692

MLflow scorer deserialization can execute caller-placed Python modules

MLflow · Third-party scorer deserialization

First documented disclosure · Review checkpoint

Summary

An artifact-upload and scorer-import chain can execute code in the MLflow server process.

Severity and exploitation evidence

Critical · 9.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A package-prefix allowlist accepts attacker-created descendants; deserialization imports and constructs the selected class before trace processing.

Conditions required

An allowed scorer package is writable by the server. No credentials in default no-auth deployments; basic-auth users need experiment/run creation and artifact-upload rights.

Potential impact

Code execution with the process’s privileges. The demonstrated container ran as root; host impact depends on mounts and isolation.

Affected versions and configurations

MLflow >=3.12.0rc0, <3.17.0, per CNA.

Fix and mitigation status

3.17.0.

Practical next steps

Upgrade, require authentication and make installed scorer packages read-only to the serving process; follow coordinated database-upgrade guidance.

Operating lesson

A package-name prefix does not prove the code under it is trusted.

Evidence and limits

The public fix PR dates to September 16, advisory October 9 and CVE October 27. Isolated marker-file demonstrations establish code execution, not a victim incident. A later HTTP 500 does not undo execution; read-only packages block this exact placement chain.

Sources