CVE-2026-116692: MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 0.7%, percentile 53: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 53% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes mlflow (PyPI) >= 3.12.0rc0, < 3.17.0, fixed in 3.17.0. Check your lockfile, including transitive dependencies.
• Editorial verdict: Patch this week. MLflow CVE-2026-116692: Unauthenticated RCE via Scorers — No exploitation is reported, but the advisory spells out a five-step chain to code execution on default no-auth MLflow servers, so upgrade to 3.17.0 or later this week and today for any server reachable beyond your own team.

What it is

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRDPARTYSCORERALLOWEDMODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.modelvalidatejson() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.

From the GitHub advisory

Summary

MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously.

An HTTP caller can combine this behavior with MLflow's built-in experiment, run, and artifact-upload endpoints:

1. Create an experiment whose local artifact location points to a writable allowed scorer package. 2. Create a run, causing MLflow to allocate / /artifacts/. 3. Upload a Python module into that run artifact directory. 4. Submit a serialized third-party scorer whose module path resolves to the uploaded file. 5. Trigger server-side import and class construction through /ajax-api/3.0/mlflow/scorer/invoke.

On the default no-auth server using the official MLflow v3.14.0 image, this produces unauthenticated arbitrary Python code execution with the privileges of the MLflow server process. The reproduced image runs the process as uid 0 and permits writes to its installed Python package tree.

Weakness type: CWE-94, CWE-470.

Product: mlflow (PyPI) · Assigned by: GitHub_M · Published: 2026-10-27

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable yes, technical impact total.
• FIRST EPSS (model of 2026-11-04): 0.70% probability of exploitation activity in the next 30 days; percentile 53.

Timeline

• 2026-10-27 — CVE record published by GitHub_M
• 2026-10-27 — GitHub-reviewed advisory GHSA-26p8-2jq9-3vq9 published (critical)
• 2026-10-27 — erroneo.us brief: MLflow CVE-2026-116692: Unauthenticated RCE via Scorers
• 2026-11-02 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-26p8-2jq9-3vq9 github.com
2. CVE.org record CVE-2026-116692 cve.org
3. NVD entry CVE-2026-116692 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com

Critical PyPI advisories · Today’s Security Digest