CVE-2026-115886: MLflow unsafe scorer

Q: Is CVE-2026-115886 actively exploited?

No confirmed active exploitation of CVE-2026-115886 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-115886?

1) Upgrade mlflow to 3.17.0 or later. 2) If patching is not immediate, uninstall trulens and trulens-providers-litellm from MLflow server environments. 3) Do not expose MLflow to the internet; put it behind an authenticating reverse proxy or VPN and block /ajax-api/3.0/mlflow/scorer/invoke, register, and GenAI evaluate endpoints for unauthenticated users. 4) Enforce egress filtering from MLflow hosts and require IMDSv2 or block 169.254.169.254. 5) Detection: review access logs for unauthenticated POSTs to the scorer endpoints, and monitor for unexpected outbound connections from MLflow servers to internal ranges or unfamiliar hosts. 6) Inventory MLflow deployments with pip freeze to identify affected versions and optional packages.

Q: What systems are affected by CVE-2026-115886?

This vulnerability affects the following AI/ML architecture patterns: ML experiment tracking servers, GenAI evaluation pipelines, MLOps platforms, LLM scoring and evaluation workflows, model registries.

Q: What is the CVSS score for CVE-2026-115886?

CVE-2026-115886 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.68%.

CISO Take

MLflow 3.12.0rc0 through 3.16.x lets an unauthenticated attacker abuse the scorer invoke endpoint to make the tracking server send attacker-controlled HTTP requests to arbitrary or internal hosts (SSRF via unsafe class selection). Although rated medium (CVSS 6.5), the flaw requires no privileges or user interaction. It only works when the optional trulens and trulens-providers-litellm packages are installed, which narrows exposure. MLflow has 698 downstream dependents and 86 other CVEs, and its OpenSSF Scorecard is a mediocre 5.4/10, so the platform deserves close attention. There is no known public exploit, Nuclei template, or KEV listing, and EPSS is not available. Upgrade to MLflow 3.17.0, and in the meantime remove the trulens packages or block access to /ajax-api/3.0/mlflow/scorer/* and restrict egress from MLflow servers, particularly to cloud metadata endpoints.

Sources:NVDGitHub AdvisoryATLASOpenSSF

What is the risk?

Medium overall. The flaw is network-reachable, low-complexity, and needs no authentication, but it needs the optional trulens and trulens-providers-litellm packages and has limited confidentiality and integrity impact (C:L/I:L). Risk rises sharply for MLflow servers exposed to the internet or running in cloud environments where internal services or metadata endpoints are reachable, because SSRF can lead to credential theft or lateral movement. There is no evidence of active exploitation and no public exploit at this time.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated POST to the MLflow scorer invoke endpoint with crafted serialized scorer data.

AML.T0049

Exploitation

Scorer.model_validate_json instantiates the trulens scorer with attacker-chosen api_base and api_key via the LiteLLM fallback.

AML.T0049

Discovery

The MLflow server sends outbound requests to internal hosts or metadata services, letting the attacker map reachable resources.

AML.T0006

Impact

Attacker accesses internal service responses or credentials and uses the MLflow host as a relay for further attacks.

AML.T0055

Initial Access

Attacker sends an unauthenticated POST to the MLflow scorer invoke endpoint with crafted serialized scorer data.

AML.T0049

Exploitation

Scorer.model_validate_json instantiates the trulens scorer with attacker-chosen api_base and api_key via the LiteLLM fallback.

AML.T0049

Discovery

The MLflow server sends outbound requests to internal hosts or metadata services, letting the attacker map reachable resources.

AML.T0006

Impact

Attacker accesses internal service responses or credentials and uses the MLflow host as a relay for further attacks.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	>= 3.12.0rc0, < 3.17.0	`3.17.0`
28.5KOpenSSF 5.5693 dependentsPushed 6d ago38% patched~68d to patchFull package profile →

Do you use MLflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade mlflow to 3.17.0 or later. 2) If patching is not immediate, uninstall trulens and trulens-providers-litellm from MLflow server environments. 3) Do not expose MLflow to the internet; put it behind an authenticating reverse proxy or VPN and block /ajax-api/3.0/mlflow/scorer/invoke, register, and GenAI evaluate endpoints for unauthenticated users. 4) Enforce egress filtering from MLflow hosts and require IMDSv2 or block 169.254.169.254. 5) Detection: review access logs for unauthenticated POSTs to the scorer endpoints, and monitor for unexpected outbound connections from MLflow servers to internal ranges or unfamiliar hosts. 6) Inventory MLflow deployments with pip freeze to identify affected versions and optional packages.

How is it classified?

Auth BypassData LeakageFrameworkAPIInferenceAML.T0006- Active Scanning AML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are managed

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-115886?

MLflow 3.12.0rc0 through 3.16.x lets an unauthenticated attacker abuse the scorer invoke endpoint to make the tracking server send attacker-controlled HTTP requests to arbitrary or internal hosts (SSRF via unsafe class selection). Although rated medium (CVSS 6.5), the flaw requires no privileges or user interaction. It only works when the optional trulens and trulens-providers-litellm packages are installed, which narrows exposure. MLflow has 698 downstream dependents and 86 other CVEs, and its OpenSSF Scorecard is a mediocre 5.4/10, so the platform deserves close attention. There is no known public exploit, Nuclei template, or KEV listing, and EPSS is not available. Upgrade to MLflow 3.17.0, and in the meantime remove the trulens packages or block access to /ajax-api/3.0/mlflow/scorer/* and restrict egress from MLflow servers, particularly to cloud metadata endpoints.

Is CVE-2026-115886 actively exploited?

No confirmed active exploitation of CVE-2026-115886 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115886?

1) Upgrade mlflow to 3.17.0 or later. 2) If patching is not immediate, uninstall trulens and trulens-providers-litellm from MLflow server environments. 3) Do not expose MLflow to the internet; put it behind an authenticating reverse proxy or VPN and block /ajax-api/3.0/mlflow/scorer/invoke, register, and GenAI evaluate endpoints for unauthenticated users. 4) Enforce egress filtering from MLflow hosts and require IMDSv2 or block 169.254.169.254. 5) Detection: review access logs for unauthenticated POSTs to the scorer endpoints, and monitor for unexpected outbound connections from MLflow servers to internal ranges or unfamiliar hosts. 6) Inventory MLflow deployments with pip freeze to identify affected versions and optional packages.

What systems are affected by CVE-2026-115886?

This vulnerability affects the following AI/ML architecture patterns: ML experiment tracking servers, GenAI evaluation pipelines, MLOps platforms, LLM scoring and evaluation workflows, model registries.

What is the CVSS score for CVE-2026-115886?

CVE-2026-115886 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.68%.

What is the AI security impact?

Affected AI Architectures

ML experiment tracking serversGenAI evaluation pipelinesMLOps platformsLLM scoring and evaluation workflowsmodel registries

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission. This issue is fixed in version 3.17.0.

Exploitation Scenario

An attacker discovers an internet-exposed MLflow server and sends an unauthenticated POST to /ajax-api/3.0/mlflow/scorer/invoke with serialized scorer JSON selecting mlflow.genai.scorers.trulens. They choose a model URI outside MLflow's native provider registry so the LiteLLM fallback is used, and set api_base to an internal service or the cloud metadata endpoint. The MLflow server sends the crafted request from inside the network, letting the attacker probe internal services, trigger actions on unauthenticated internal APIs, or reach metadata services to harvest cloud credentials.

Weaknesses (CWE)

CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')Primary CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')Primary CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)Primary CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CWE-918Server-Side Request Forgery (SSRF)

CWE-470 — Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'): The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

[Architecture and Design] Refactor your code to avoid using reflection.
[Architecture and Design] Do not use user-controlled inputs to select and load classes or code.

Source: MITRE CWE corpus.