VulnSocial

CVE-2026-116692

LOWCVSS 9.8 · CRITICAL

Signal is active with 8 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94CWE-470

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 10 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked at 8 mentions on most recent observed day (2026-10-28)
  • 10 total mentions across 2 days

Deep dive

Activity timeline10 mentions / 2d
02468Mentions · 2026-10-27: 2Mentions · 2026-10-28: 810-2710-28
Referenced assets5 URLs
Full discourse10 posts
  • 美濃加茂まむ@superdoccimo

    MLflowの認証なしRCE（CVE-2026-116692、CVSS 9.8）。許可リストの前方一致がなぜ攻撃者のモジュールを通したのか。3.16.0と3.17.0のwheel差分から、完全一致化・コード実行の分離・認可チェックの変更を読み解きます。 https://x.com/i/article/2115293334272983041

    10030675
    21.0K followersView on X
  • Parameter Watch@ParameterWatch

    ⚠️ CVE-2026-116692 (9.8) ⚠️ MLflow, the open source AI engineering platform, lets an attacker run their own code on the server. 3.12.0rc0 up to (but not including) 3.17.0 is affected. Upgrade to 3.17.0. https://t.co/zfxHcfSFr5

    1002088
    21 followersView on X
  • Eliran Emuna@EmunaEliran

    🚨 MLflow unauthenticated RCE (CVE-2026-116692), CVSS 3.1 9.8 (CNA) 🧠 Scorer deserialization imports a caller-uploaded module ⚠️ No-auth servers: no credentials needed ✅ Affected 3.12.0rc0 to <3.17.0; fixed in 3.17.0. Not in KEV 🔗 https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9 #AppSec #MLOps https://t.co/lgOxMQWTl4

    0001053
    76 followersView on X
  • Upwind Security MDR@UpwindMDR

    🚨 CRITICAL - RCE & Arbitrary File Read Vulnerabilities Patched in MLflow Two security vulnerabilities in MLflow allow unauthenticated attackers to compromise tracking servers: • CVE-2026-116692 (CVSS 9.8 Critical): Remote code execution via third-party scorer deserialization importing caller-placed artifact modules. • CVE-2026-116690 (CVSS 7.5 High): Path traversal in prompt model version source handling enabling arbitrary local file read. 👉 Affected: MLflow >= 3.10.0 / 3.12.0rc0 prior to 3.17.0 | Upgrade to v3.17.0 or later immediately

    0000023
    371 followersView on X
  • NewsWithAI@newswithai_hq

    MLflow has a critical RCE flaw, CVE-2026-116692 (CVSS 9.8). On a server with no auth, anyone who can reach it can run Python code via scorer deserialization. Affects 3.12.0 up to 3.17.0. Fixed in 3.17.0. Update, and put auth in front of tracking servers. https://t.co/jRxrchLyA3

    000009
    21 followersView on X
  • The Hacker Wire@TheHackerWire

    🚨 CVE-2026-116692 (CVSS 9.8 Critical) Deserialization flaw in MLflow allows unauthenticated remote attackers to execute arbitrary code via third-party scorer module loading. ⚡ Action: Upgrade MLflow to >= v3.17.0. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116692/ https://t.co/fzp5NkVerO

    0000047
    201 followersView on X
  • KKAA Solutions@kkaasolutions

    CVE-2026-116692 (CRITICAL / 9.8) — MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.... https://nvd.nist.gov/vuln/detail/CVE-2026-116692 #Python

    0000028
    6 followersView on X
  • Alvif Sandana Mahardika@siDandott

    Three MLflow flaws at once — worst is unauthenticated RCE to root. CVE-2026-116692: scorer deserialization lets attackers upload a malicious module and trigger server-side import. Official v3.14.0 image runs as uid 0. Fix: 3.17.0. Is your MLflow unauthenticated?

    0000032
    42 followersView on X
  • DailyCVE@dailycve

    🔴 MLflow, Insecure Deserialization Vulnerability, #CVE-2026-116692 (Critical) -DC-Oct2026-3860 https://dailycve.com/mlflow-insecure-deserialization-vulnerability-cve-2026-116692-critical-dc-oct2026-3860/

    0000038
    247 followersView on X
  • Jayant@de2pressed

    An unconfirmed report flags CVE-2026-116692, a critical MLflow scorer flaw letting attackers run server code, affecting 3.12.0rc0 up to but not including 3.17.0. Upgrade to 3.17.0. https://t.co/TAbh7Y1YnW

    0000043
    32 followersView on X

Explore more

Back to dashboard