MLflow third-party scorer deserialization RCE — unauthenticated code execution on MLflow servers (CVE-2026-116692)
Severity: critical · Patch status: patched · Since 2026-10-27 · CVE-2026-116692
MLflow 3.12.0 introduced deserialization of third-party scorers that imports a request-controlled Python module under one of four allowed package prefixes (mlflow.genai.scorers.ragas/deepeval/trulens/phoenix) and instantiates a request-controlled class. An unauthenticated HTTP caller can chain this with MLflow's experiment, run, and artifact-upload endpoints: create an experiment whose artifact location points inside the installed MLflow package tree, upload a Python module as a run artifact, then trigger import and constructor execution via /ajax-api/3.0/mlflow/scorer/invoke. On the default no-auth server using the official v3.14.0 image (running as uid 0), this yields arbitrary Python code execution with server-process privileges. A harmless public PoC writes a marker file. Fixed in MLflow 3.17.0.
What to do
- Upgrade MLflow to 3.17.0 or later immediately
- If upgrade is delayed, require authentication on MLflow servers and restrict network exposure
- Restrict write permissions on the installed Python package tree and run MLflow as a non-root user
- Audit servers for unexpected modules or artifacts under mlflow/genai/scorers/ package directories
- Review artifact-location settings and block experiments pointing into site-packages
Fixed versions
Sources
All live incidents on Threat Watch
