Executive brief
MLflow, a popular platform for managing machine learning lifecycles, contains a security flaw in its model serving component. An attacker can execute unauthorized commands on the server by providing a specially crafted model location. This could allow a low-privileged user to take full control of the machine learning server or access sensitive data.
Technical details
A command injection vulnerability (CWE-78) exists in MLflow when the `enable_mlserver=True` flag is used during model serving. The root cause is the lack of sanitization for the `model_uri` parameter, which is directly embedded into a shell command executed via `bash -c`. An attacker can use shell metacharacters like backticks or `$()` within the `model_uri` to achieve command substitution. This can be exploited locally or via an adjacent network depending on the deployment, potentially leading to privilege escalation if a high-privileged service processes models from directories writable by lower-privileged users. At the time of the advisory, the vulnerability was reported to affect the latest version of MLflow.
Affected products
- mlflow mlflow latest
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory