---
title: "CVE-2026-116692: MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules"
url: https://erroneo.us/security/cve/CVE-2026-116692/
description: "CVE-2026-116692 (mlflow (PyPI)): MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-10-27
date_modified: 2026-11-02
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-116692"
kev: false
cvss: 9.8
epss: 0.00704
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-116692: MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.7% , percentile 53: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 53% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes mlflow (PyPI) >= 3.12.0rc0, < 3.17.0, fixed in 3.17.0 . Check your lockfile, including transitive dependencies.
- Editorial verdict: Patch this week. MLflow CVE-2026-116692: Unauthenticated RCE via Scorers — No exploitation is reported, but the advisory spells out a five-step chain to code execution on default no-auth MLflow servers, so upgrade to 3.17.0 or later this week and today for any server reachable beyond your own team.

## What it is

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRDPARTYSCORERALLOWEDMODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.modelvalidatejson() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.

## Affected packages

- PyPI `mlflow` >= 3.12.0rc0, < 3.17.0 → fixed: 3.17.0

## Affected products (CVE record)

- mlflow mlflow: >= 3.12.0rc0, < 3.17.0

## Severity

- GitHub_M CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-11-05): 0.70% probability of exploitation activity in the next 30 days; percentile 53.

## Sources

- [GitHub Advisory GHSA-26p8-2jq9-3vq9](https://github.com/advisories/GHSA-26p8-2jq9-3vq9)
- [CVE.org record CVE-2026-116692](https://www.cve.org/CVERecord?id=CVE-2026-116692)
- [NVD entry CVE-2026-116692](https://nvd.nist.gov/vuln/detail/CVE-2026-116692)
- [github.com](https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9)
- [github.com](https://github.com/mlflow/mlflow/pull/25906)
- [github.com](https://github.com/mlflow/mlflow/commit/a732443e695c3c677680c54320efc394c81654ab)
- [github.com](https://github.com/mlflow/mlflow/releases/tag/v3.17.0)

---
Source page: https://erroneo.us/security/cve/CVE-2026-116692/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt