MLflow: Remote code execution via third-party scorer deserialization

Summary

MLflow versions 3.12.0rc0 up to 3.17.0 (excluded) accept third-party scorer modules that are sub-modules of allow-listed packages, so the server can import a Python file that an attacker has placed in a writable scorer package. The attacker can then execute code on the MLflow server. Authentication-disabled deployments can be exploited without credentials, while basic-auth deployments require a principal that can create experiments, runs and artifacts. The allowed scorer package must also be writable by the server process.

Affected

• MLflow >= 3.12.0rc0 and < 3.17.0

Fixed in

• Upgrade to MLflow 3.17.0 or later.

Workaround

• Unknown. The vendor has not published a workaround.
• Interim measure only: make the allowed scorer package directories read-only for the server process and restrict network access to the tracking server. This does not replace patching.

Exploitation

• No evidence of exploitation in the wild as of 28 October 2026.
• The vendor advisory describes a reproduction path; no weaponised public exploit was found in Metasploit or Exploit-DB.
• Not listed in the CISA KEV catalog. EPSS: 0.7 % (percentile 53).

Our recommendation

• Inventory all MLflow instances, including container images, and record their versions.
• Upgrade all affected instances to 3.17.0 or later with priority.
• Check authentication and network exposure of every instance. Instances reachable from networks with authentication disabled should be treated as potentially compromised until reviewed.
• Review logs and artifact storage for unexpected uploaded Python files and unexpected processes.
• Apply interim measures only until the upgrade is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  foxcornlab/mlflow-scorer-scanner

Research sources

• GitHub Security Advisory GHSA-26p8-2jq9-3vq9 github.com
• Fix commit a732443 (mlflow/mlflow) github.com
• Pull Request #25906 (mlflow/mlflow) github.com
• MLflow release v3.17.0 github.com
• OSV GHSA-26p8-2jq9-3vq9 osv.dev
• GitLab Advisory CVE-2026-116692 (PyPI mlflow) advisories.gitlab.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:24.