Quick answers
- Is CVE-2026-0596 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-0596 being exploited in the wild.
- How severe is CVE-2026-0596?
- Critical severity, with a CVSS score of 9.6, published 31 March 2026.
- Which products and versions are affected?
- mlflow (PyPI) < 3.9.0, ECOSYSTEM:introduced=0,fixed=3.9.0.
- Is there a fix for CVE-2026-0596?
- Yes. mlflow (PyPI): upgrade to 3.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-0596 attacked?
- It is attacked with local access or from the adjacent network, in a software library.
- Am I affected by CVE-2026-0596?
- Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mlflow (PyPI): upgrade to 3.9.0 or later
pip install "mlflow>=3.9.0"
Technical details
A command injection vulnerability (CWE-78) exists in MLflow when the `enable_mlserver=True` flag is used during model serving. The root cause is the lack of sanitization for the `model_uri` parameter, which is directly embedded into a shell command executed via `bash -c`. An attacker can use shell metacharacters like backticks or `$()` within the `model_uri` to achieve command substitution. This can be exploited locally or via an adjacent network depending on the deployment, potentially leading to privilege escalation if a high-privileged service processes models from directories writable by lower-privileged users. At the time of the advisory, the vulnerability was reported to affect the latest version of MLflow.
Affected products
- mlflow mlflow latest
Identifiers
- CVE-2026-0596
- GHSA-rvhj-8chj-8v3c
- PYSEC-2026-424
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory