Zero Radar
← feed
CriticalVulnerabilityCVE-2026-116692updated 27 Oct 2026, 21:27 UTC

MLflow scorer feature lets attackers run Python code on the server

A flaw in MLflow lets someone send a crafted request that makes the server load and run their own Python code. If authentication is turned off, no password is needed.

Fixed in mlflow 3.17.0Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesmlflow 3.17.0 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestsCalls MLflow experiment, run and artifact endpoints
  2. 2Uploads Python modulePlaces file under a writable scorer package
  3. 3Submits crafted scorerModule path passes the prefix-only check
  4. 4Server imports moduleAttacker class is constructed during deserialization
  5. ResultAttacker runs code on the MLflow server

What happened

MLflow 3.12.0rc0 through 3.16.x accepts request-selected module paths for third-party scorers that merely start with an allowed package name, so an attacker who can upload a file into a writable allowed scorer package gets it imported and instantiated during scorer deserialization via /ajax-api/3.0/mlflow/scorer/invoke.

Why it is dangerous: Successful exploitation gives arbitrary code execution with the privileges of the MLflow server process, which the advisory reports can run as root in the official image. Deployments with authentication disabled are exposed without credentials; basic-auth deployments are exposed to any user who can create experiments, runs and upload artifacts.

Are you affected?

You are affected if you run MLflow from 3.12.0rc0 up to but not including 3.17.0 (pip package mlflow), especially with authentication disabled or with users who can create experiments and upload artifacts.

Package / productAffected versionsFixed in
mlflow · pip>= 3.12.0rc0, < 3.17.03.17.0

What to do

  1. Upgrade the mlflow pip package to 3.17.0 or later.
  2. If you cannot upgrade right away, enable authentication and restrict who can create experiments and upload artifacts.
  3. Make the MLflow scorer package directories read-only for the server process.
  4. Review the server for unexpected uploaded Python files in run artifact directories.

Timeline

  1. 27 Oct 2026, 21:18 UTC
    Publicly disclosed
  2. 27 Oct 2026, 21:18 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 21:22 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 21:27 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 21:27 UTC
    Fixed version published: mlflow 3.17.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116692 · GHSA-26p8-2jq9-3vq9
CVSS
9.8 / 10
EPSS
0.7% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 21:18 UTC
On Zero Radar
27 Oct 2026, 21:22 UTC (4 min after disclosure)
Last change
27 Oct 2026, 21:27 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

MLflow scorer feature lets attackers run Python code on the server · Zero Radar