CVE-2026-116692

Summary

MLflow's scorer deserialization logic allows arbitrary code execution by loading unauthorized third-party modules due to overly permissive module resolution in mlflow/genai/scorers/base.py between versions 3.12.0rc0 and 3.17.0, enabling unauthenticated attackers (in auth-disabled deployments) or authenticated attackers with artifact upload permissions to execute arbitrary Python code via crafted scorer classes.

Exploitability

Exploitation requires either an auth-disabled deployment or a principal with experiment/run creation and artifact upload permissions; the server process must have write access to the allowed scorer package directory.

Blast radius

Successful exploitation grants full system compromise (CIA impact: high) including remote code execution, data exfiltration, and potential lateral movement within the ML infrastructure.

Detection

Monitor for artifact upload requests to experiment run directories followed by /ajax-api/3.0/mlflow/scorer/invoke calls referencing non-standard scorer modules under allowed packages; look for Python import attempts of unexpected submodules in server logs or process execution traces.

Prioritized remediation

Upgrade to MLflow version 3.17.0 or later, which fixes the overly permissive module resolution in scorer deserialization.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.