# CVE-2026-118627: MLflow SHAP load_explainer deserialization of untrusted data

Source: https://junglewise.ai/threats/cve-2026-118627-mlflow-shap-load-explainer-deserialization-of-untrusted-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-118627 · Severity: high · CVSS 7.8 · Published 2026-11-04

MLflow is a platform for managing machine learning workflows and model deployments. A vulnerability in how it deserializes SHAP explainer models allows attackers to execute arbitrary code on a user's system if they visit a malicious page or open a malicious file. This could lead to complete compromise of the machine learning environment and associated data.

Technologies: [Mlflow](https://junglewise.ai/threats/technologies/mlflow-mlflow). Vendors: [MLflow](https://junglewise.ai/threats/vendors/mlflow).

## Quick answers

**Is CVE-2026-118627 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118627 being exploited in the wild.

**How severe is CVE-2026-118627?** High severity, with a CVSS score of 7.8, published 4 November 2026.

**Which products and versions are affected?** MLflow MLflow.

**Is there a fix for CVE-2026-118627?** Yes: fixed in MLflow 3.17.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118627 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-118627?** Check whether you run Mlflow. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in MLflow 3.17.0

## Technical details

The vulnerability exists in MLflow's SHAP load_explainer functionality, where insufficient validation of user-supplied data permits deserialization of untrusted objects. An attacker can craft a malicious SHAP explainer model file that executes arbitrary code when deserialized. User interaction is required: the victim must visit a crafted page or open a malicious file.

## Affected products

- MLflow MLflow

## Timeline

- 2026-04-15: disclosed: Vulnerability reported to vendor
- 2026-10-29: advisory: Coordinated public release of advisory
- 2026-10-29: patched: Fixed in MLflow 3.17.0

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-843/](https://www.zerodayinitiative.com/advisories/ZDI-26-843/)

## Related threats

- [MLflow path traversal in FileStore log outputs API](https://junglewise.ai/threats/cve-2026-127202-mlflow-before-3-18-0-using-the-filestore-backend-contains-a-path)
- [MLflow get-artifacts server-side request forgery information disclosure](https://junglewise.ai/threats/cve-2026-118628-mlflow-get-artifacts-server-side-request-forgery-information)
- [MLflow Tracking Server missing authorization in get_endpoints](https://junglewise.ai/threats/cve-2026-118625-mlflow-tracking-server-missing-authorization-privilege)
- [MLflow Tracking Server authorization bypass in Jobs API](https://junglewise.ai/threats/cve-2026-118624-mlflow-tracking-server-jobs-missing-authorization-information)
- [MLflow PickleEvaluationArtifact deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-118623-mlflow-pickleevaluationartifact-deserialization-of-untrusted)