CVE-2026-116692

Name of the Vulnerable Software and Affected Versions MLflow versions 3.12.0 through 3.16.x

Description Third-party scorer deserialization in mlflow/genai/scorers/base.py allows the import of request-selected descendants of allowed modules rather than requiring an exact match. An attacker can use artifact endpoints to place a malicious Python module within a writable allowed package and trigger its execution via the /ajax-api/3.0/mlflow/scorer/invoke endpoint. The Scorer.model validate json() function imports the module and instantiates the class before any trace processing or validation occurs. In deployments where authentication is disabled, this allows unauthenticated arbitrary Python code execution. In basic-auth deployments, it requires a principal with permissions to create experiments, runs, and upload artifacts. The exploitation depends on the server process having write access to the allowed scorer package directory.

Recommendations Update to version 3.17.0. As a temporary mitigation, ensure the server process does not have write permissions to the installed Python package directories, specifically those containing the allowed scorer modules.