CVE-2026-115886: MLflow unsafe deserialization in scorer endpoints

CVE-2026-115886 · Severity: medium · CVSS 6.5 · Published 2026-10-23

MLflow's tracking server exposes an unauthenticated endpoint that allows attackers to instantiate arbitrary code classes with attacker-controlled parameters. When the optional trulens integration is installed, this enables an attacker to force the server to make HTTP requests to any destination with crafted headers, effectively using the server as a proxy to attack internal systems or cloud infrastructure from within the server's network.

Technologies: Mlflow, mlflow (PyPI). Vendors: MLflow, PyPI.

Quick answers

Is CVE-2026-115886 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115886 being exploited in the wild.
How severe is CVE-2026-115886?
Medium severity, with a CVSS score of 6.5, published 23 October 2026.
Which products and versions are affected?
Mlflow 3.12.0rc0 to 3.16.x; mlflow (PyPI) >= 3.12.0rc0, < 3.17.0, ECOSYSTEM:introduced=3.12.0rc0,fixed=3.17.0.
Is there a fix for CVE-2026-115886?
Yes. mlflow (PyPI): upgrade to 3.17.0 or later. Until then: Restrict network access to the MLflow tracking server to only trusted clients; disable or remove the optional trulens and trulens-providers-litellm packages if GenAI evaluation features are not required.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115886 attacked?
It is attacked over the network.
Am I affected by CVE-2026-115886?
Check whether you run Mlflow or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mlflow (PyPI): upgrade to 3.17.0 or later
    pip install "mlflow>=3.17.0"

Restrict network access to the MLflow tracking server to only trusted clients; disable or remove the optional trulens and trulens-providers-litellm packages if GenAI evaluation features are not required.</anigation> </invoke>

Technical details

The vulnerability exists in MLflow's reflective deserialization of third-party scorer classes in the unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke endpoint. While the module import path is allowlisted, the class attribute and constructor kwargs are unconstrained. An attacker can route to the trulens LiteLLM provider by specifying an external model URI, which forwards attacker-controlled kwargs directly to litellm.completion(), enabling injection of arbitrary api_base and api_key values that result in server-originated HTTP requests to attacker-controlled hosts.

Affected products

  • MLflow MLflow

Identifiers

  • CVE-2026-115886
  • GHSA-2wqp-q3c6-ccj5

Timeline

  • 2026-10-23: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.