CVE-2026-116692: MLflow scorer deserialization

Q: Is CVE-2026-116692 actively exploited?

No confirmed active exploitation of CVE-2026-116692 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-116692?

1) Upgrade MLflow to 3.17.0 or later (fix in PR #25906, commit a732443). 2) Until patched, do not expose the tracking server to untrusted networks; put it behind a VPN or authenticated reverse proxy. 3) Enable MLflow authentication and limit who can create experiments, runs and upload artifacts. 4) Make the allowed scorer package directories read-only for the server process and run it as a low-privilege user in a container. 5) Block or monitor requests to /ajax-api/3.0/mlflow/scorer/invoke and unexpected artifact uploads of .py files. 6) Hunt for unexpected Python files under the scorer package path and for anomalous child processes or outbound connections from the MLflow server. 7) Rotate credentials accessible to the server if compromise is suspected, and verify the integrity of registered models.

Q: What systems are affected by CVE-2026-116692?

This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, experiment tracking servers, model registries, GenAI evaluation pipelines, training pipelines.

Q: What is the CVSS score for CVE-2026-116692?

CVE-2026-116692 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.70%.

CISO Take

MLflow 3.12.0rc0 through 3.16.x lets a caller upload a Python module through artifact endpoints and then have the server import and instantiate it via the third-party scorer invoke endpoint, giving arbitrary code execution on the tracking server (CWE-94, CVSS 9.8). It needs no credentials when authentication is disabled, which is a common default for internal MLflow deployments, and only an account that can create experiments, runs and artifacts when basic auth is on. The exploit also needs the allowed scorer package to be writable by the server process. No EPSS score, public exploit, Nuclei template or KEV listing exists yet, but the attack chain is simple and the advisory plus patch diff are public, so weaponization should be expected quickly. MLflow servers typically hold experiment data, model artifacts and cloud credentials, so compromise is a direct path to model tampering and lateral movement. Upgrade to 3.17.0 now, and until then restrict network access to the tracking server, enable authentication, and make the scorer package directory read-only.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Critical. Network-reachable, low complexity, no user interaction, and no privileges on deployments with authentication disabled. Exposure depends on the writable-package precondition, which lowers real-world likelihood somewhat. There is no confirmed exploitation, no public exploit and no EPSS data, so the current exploitation likelihood is unquantified. The public patch and advisory make reverse-engineering easy. Impact is full compromise of the MLflow server process (confidentiality, integrity, availability). Many MLflow instances run internally with auth off, which raises exposure.

How does the attack unfold?

Initial Access

Attacker reaches an MLflow tracking server with authentication disabled, or uses a low-privilege account on one with basic auth.

AML.T0049

Payload Staging

Attacker uploads a malicious Python module as an artifact so it lands beneath a writable allowed scorer package.

AML.T0079

Exploitation

A request to /ajax-api/3.0/mlflow/scorer/invoke makes the server import the module and construct the attacker's class.

AML.T0050

Impact

Attacker steals credentials, tampers with registered models and artifacts, and pivots into the ML platform.

AML.T0010.001

Initial Access

Attacker reaches an MLflow tracking server with authentication disabled, or uses a low-privilege account on one with basic auth.

AML.T0049

Payload Staging

Attacker uploads a malicious Python module as an artifact so it lands beneath a writable allowed scorer package.

AML.T0079

Exploitation

A request to /ajax-api/3.0/mlflow/scorer/invoke makes the server import the module and construct the attacker's class.

AML.T0050

Impact

Attacker steals credentials, tampers with registered models and artifacts, and pivots into the ML platform.

AML.T0010.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	>= 3.12.0rc0, < 3.17.0	`3.17.0`
28.5KOpenSSF 5.5693 dependentsPushed 6d ago38% patched~68d to patchFull package profile →

Do you use MLflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade MLflow to 3.17.0 or later (fix in PR #25906, commit a732443). 2) Until patched, do not expose the tracking server to untrusted networks; put it behind a VPN or authenticated reverse proxy. 3) Enable MLflow authentication and limit who can create experiments, runs and upload artifacts. 4) Make the allowed scorer package directories read-only for the server process and run it as a low-privilege user in a container. 5) Block or monitor requests to /ajax-api/3.0/mlflow/scorer/invoke and unexpected artifact uploads of .py files. 6) Hunt for unexpected Python files under the scorer package path and for anomalous child processes or outbound connections from the MLflow server. 7) Rotate credentials accessible to the server if compromise is suspected, and verify the integrity of registered models.

How is it classified?

Code ExecutionSupply ChainAuth BypassFrameworkAPIAML.T0010.001- AI Software AML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-116692?

MLflow 3.12.0rc0 through 3.16.x lets a caller upload a Python module through artifact endpoints and then have the server import and instantiate it via the third-party scorer invoke endpoint, giving arbitrary code execution on the tracking server (CWE-94, CVSS 9.8). It needs no credentials when authentication is disabled, which is a common default for internal MLflow deployments, and only an account that can create experiments, runs and artifacts when basic auth is on. The exploit also needs the allowed scorer package to be writable by the server process. No EPSS score, public exploit, Nuclei template or KEV listing exists yet, but the attack chain is simple and the advisory plus patch diff are public, so weaponization should be expected quickly. MLflow servers typically hold experiment data, model artifacts and cloud credentials, so compromise is a direct path to model tampering and lateral movement. Upgrade to 3.17.0 now, and until then restrict network access to the tracking server, enable authentication, and make the scorer package directory read-only.

Is CVE-2026-116692 actively exploited?

No confirmed active exploitation of CVE-2026-116692 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-116692?

1) Upgrade MLflow to 3.17.0 or later (fix in PR #25906, commit a732443). 2) Until patched, do not expose the tracking server to untrusted networks; put it behind a VPN or authenticated reverse proxy. 3) Enable MLflow authentication and limit who can create experiments, runs and upload artifacts. 4) Make the allowed scorer package directories read-only for the server process and run it as a low-privilege user in a container. 5) Block or monitor requests to /ajax-api/3.0/mlflow/scorer/invoke and unexpected artifact uploads of .py files. 6) Hunt for unexpected Python files under the scorer package path and for anomalous child processes or outbound connections from the MLflow server. 7) Rotate credentials accessible to the server if compromise is suspected, and verify the integrity of registered models.

What systems are affected by CVE-2026-116692?

This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, experiment tracking servers, model registries, GenAI evaluation pipelines, training pipelines.

What is the CVSS score for CVE-2026-116692?

CVE-2026-116692 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.70%.

What is the AI security impact?

Affected AI Architectures

MLOps platformsexperiment tracking serversmodel registriesGenAI evaluation pipelinestraining pipelines

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.

Exploitation Scenario

An attacker finds an MLflow tracking server with authentication disabled, or uses a low-privilege account on one with basic auth. They create an experiment and run, upload a malicious Python module as an artifact so it lands beneath a writable allowed scorer package, then POST to /ajax-api/3.0/mlflow/scorer/invoke naming that module and class. Scorer.model_validate_json() imports the module and constructs the class, running the payload with the server's privileges. The attacker steals cloud and artifact-store credentials, backdoors production models in the registry, and uses the host as a pivot into the ML platform.

Weaknesses (CWE)

CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')Primary CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-470 — Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'): The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

[Architecture and Design] Refactor your code to avoid using reflection.
[Architecture and Design] Do not use user-controlled inputs to select and load classes or code.

Source: MITRE CWE corpus.