CVE-2026-116692: MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRDPARTYSCORERALLOWEDMODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.modelvalidatejson() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MLflowto a version that resolves this vulnerability.Fixed in 3.17.0
Event History
Frequently Asked Questions
Which deployments are exposed without attacker credentials?
MLflow deployments with authentication disabled are exposed without credentials if the server process can write to an allowed third-party scorer package. An attacker can use artifact endpoints to place a Python module beneath that writable package.
What access is required when basic authentication is enabled?
The attacker needs a principal that can create an experiment and run and upload artifacts. The allowed scorer package must also be writable by the MLflow server process.
How can I assess whether a deployment is affected?
Check whether MLflow is in the affected range from 3.12.0rc0 up to, but not including, 3.17.0. Also determine whether authentication is disabled or whether authenticated users can create experiments and runs and upload artifacts, and whether an allowed scorer package is writable by the server process.
What version resolves the issue?
The issue is fixed in MLflow version 3.17.0.