Executive brief
MLflow, a platform used to manage machine learning lifecycles, contains a security flaw that allows for unauthorized command execution. By providing a specially crafted container image name, an attacker can run arbitrary code on the underlying system. This could lead to a total compromise of the environment, including the theft of sensitive training data or disruption of machine learning pipelines.
Technical details
A command injection vulnerability exists in MLflow's SageMaker integration module (`mlflow/sagemaker/__init__.py`). The root cause is the direct interpolation of user-supplied container image names into shell commands executed via `os.system()` without proper sanitization. An attacker can exploit this by providing a malicious string to the `--container` CLI parameter. This allows for arbitrary code execution in the context of the MLflow process. The vulnerability is addressed in MLflow version 3.7.0.
Affected products
- MLflow MLflow before 3.7.0
- Red Hat OpenShift AI (RHOAI) Affected
Timeline
- 2025-01-01: other: Initial Red Hat VEX release date
- 2026-03-15: disclosed: Reported via huntr.dev and Red Hat Bugzilla
- 2026-03-16: advisory: NVD publication date