CVE-2026-118627: MLflow: SHAP explainer deserialization allows RCE

AWAITING NVD

Published November 3, 2026

CISO Take

MLflow has a deserialization-of-untrusted-data flaw (CWE-502) in how it loads SHAP explainer models, so a crafted explainer file or page can run arbitrary code as the user who opens it. No CVSS score, EPSS value, KEV listing, public exploit or Nuclei template exists yet, so exploitation likelihood is unquantified. The blast radius is still large: MLflow has 695 downstream dependents and 95 other CVEs, and its package risk score is 81/100 with an OpenSSF Scorecard of 5.4/10. The advisory (ZDI-26-843) lists no patched version, so check the MLflow release notes and ZDI advisory for a fix before relying on any upgrade. Until then, load only explainers from trusted, integrity-verified sources, and keep MLflow tracking servers and notebooks on hosts with no production credentials.

Sources:NVDZDIATLASOpenSSF

What is the risk?

Severity is unscored (no CVSS), so treat it as high until scoring is published, because CWE-502 deserialization flaws that yield RCE are typically high impact. The advisory says user interaction is required (opening a malicious file or visiting a malicious page), which reduces mass-exploitation potential but fits phishing and model-sharing scenarios. There is no public exploit, no EPSS data and no KEV listing at publication, and ZDI-coordinated disclosures often precede exploit details. Exposure is highest where data scientists load third-party or shared SHAP explainers, or where MLflow runs with broad cloud and data credentials. Confidence in these conclusions is MEDIUM, as they rest on a single ZDI advisory with no affected-version data.

How does the attack unfold?

Initial Access

Attacker delivers a malicious SHAP explainer file or link via a phishing message, a shared artifact store or a model hub.

AML.T0011.000

Exploitation

The victim loads the explainer with MLflow, triggering unsafe deserialization and code execution.

AML.T0018.002

Credential Access

The attacker harvests cloud, registry and tracking-server credentials available to the user.

Impact

The attacker exfiltrates datasets and models or tampers with registered models, compromising downstream ML deployments.

AML.T0048.004

Initial Access

Attacker delivers a malicious SHAP explainer file or link via a phishing message, a shared artifact store or a model hub.

AML.T0011.000

Exploitation

The victim loads the explainer with MLflow, triggering unsafe deserialization and code execution.

AML.T0018.002

Credential Access

The attacker harvests cloud, registry and tracking-server credentials available to the user.

Impact

The attacker exfiltrates datasets and models or tampers with registered models, compromising downstream ML deployments.

AML.T0048.004

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 2d ago36% patched~68d to patchFull package profile →

Do you use MLflow? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Check the MLflow release notes and the ZDI-26-843 advisory for a fixed version, and upgrade as soon as one is available (affected and patched ranges are currently unknown). 2) Do not load SHAP explainers or other pickled or serialized artifacts from untrusted sources, and require provenance and hash verification for shared artifacts. 3) Restrict write access to MLflow artifact stores and model registries so attackers cannot plant malicious explainers. 4) Run notebooks and MLflow clients under least-privilege accounts, in sandboxed or containerized environments, with short-lived credentials. 5) Detect by monitoring for unexpected child processes, outbound connections or shell spawns from Python processes that call mlflow.shap.load_explainer, and audit registries for recently modified explainer artifacts. 6) Train staff not to open unsolicited model files or links.

How is it classified?

Code ExecutionSupply ChainFrameworkModelAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0018.002- Embed Malware AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Responses to AI risks are developed, planned, and documented

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-118627?

Is CVE-2026-118627 actively exploited?

No confirmed active exploitation of CVE-2026-118627 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118627?

1) Check the MLflow release notes and the ZDI-26-843 advisory for a fixed version, and upgrade as soon as one is available (affected and patched ranges are currently unknown). 2) Do not load SHAP explainers or other pickled or serialized artifacts from untrusted sources, and require provenance and hash verification for shared artifacts. 3) Restrict write access to MLflow artifact stores and model registries so attackers cannot plant malicious explainers. 4) Run notebooks and MLflow clients under least-privilege accounts, in sandboxed or containerized environments, with short-lived credentials. 5) Detect by monitoring for unexpected child processes, outbound connections or shell spawns from Python processes that call mlflow.shap.load_explainer, and audit registries for recently modified explainer artifacts. 6) Train staff not to open unsolicited model files or links.

What systems are affected by CVE-2026-118627?

This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, Model registries, Training pipelines, Model explainability workflows, Jupyter/notebook environments.

What is the CVSS score for CVE-2026-118627?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

MLOps platformsModel registriesTraining pipelinesModel explainability workflowsJupyter/notebook environments

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0018.002Embed Malware

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loading of SHAP explainer models. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30301.

Exploitation Scenario

An attacker builds a SHAP explainer artifact containing a malicious serialized payload and shares it through a public model hub, a shared artifact store or a phishing message framed as a model-interpretability report. A data scientist or an automated pipeline loads it with MLflow's SHAP load_explainer function. Deserialization executes the payload with the user's privileges, giving the attacker a shell. The attacker then harvests cloud and registry credentials, exfiltrates datasets and models, and can modify registered models to poison downstream deployments.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.