Code Injection in MLflow - CVE-2026-116692
Published: November 9, 2026
Vulnerability identifier: #VU162799
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116692
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to execute arbitrary Python code with the MLflow server process's privileges on servers with authentication disabled.
The vulnerability exists due to third-party scorer deserialization trusting package-name prefixes when importing caller-selected modules beneath writable scorer packages. An unauthenticated remote attacker can create an experiment and run, upload a malicious Python artifact beneath an allowed package, and invoke the scorer to execute it without user interaction.
Affected software
MLflow
How to mitigate CVE-2026-116692
Install security update from vendor's website.
MLflow - update to 3.17.0