CVE-2026-116692: MLflow arbitrary code execution in third-party scorer deserialization

CVE-2026-116692 · Severity: critical · CVSS 9.8 · Published 2026-10-27

MLflow is an open-source platform for managing machine learning and AI models. A flaw in its third-party scorer deserialization allows attackers to execute arbitrary Python code by placing a malicious module beneath an allowed package directory and invoking it through the scorer API. On deployments without authentication, this requires no credentials; with authentication enabled, an attacker needs the ability to create experiments and upload artifacts.

Technologies: Mlflow, mlflow (PyPI). Vendors: MLflow, PyPI.

Quick answers

Is CVE-2026-116692 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116692 being exploited in the wild.
How severe is CVE-2026-116692?
Critical severity, with a CVSS score of 9.8, published 27 October 2026.
Which products and versions are affected?
Mlflow 3.12.0rc0 to 3.16.x; mlflow (PyPI) >= 3.12.0rc0, < 3.17.0, ECOSYSTEM:introduced=3.12.0rc0,fixed=3.17.0.
Is there a fix for CVE-2026-116692?
Yes. mlflow (PyPI): upgrade to 3.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116692 attacked?
It is attacked over the network.
Am I affected by CVE-2026-116692?
Check whether you run Mlflow or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mlflow (PyPI): upgrade to 3.17.0 or later
    pip install "mlflow>=3.17.0"

Technical details

The vulnerability exists in mlflow/genai/scorers/base.py where third-party scorer deserialization accepts request-selected module descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than exact matches. An attacker can upload a Python module beneath a writable allowed package (via artifact endpoints) and submit it through /ajax-api/3.0/mlflow/scorer/invoke, causing Scorer.model_validate_json() to import the module and construct the class, executing arbitrary code before validation. The allowed scorer package must be writable by the server process.

Affected products

  • MLflow MLflow 3.12.0rc0 to 3.16.x

Identifiers

  • CVE-2026-116692
  • GHSA-26p8-2jq9-3vq9

Timeline

  • 2026-10-27: disclosed
  • 2026-09-16: patched: Fix commit a732443e695c3c677680c54320efc394c81654ab merged

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.