{"data":{"id":"4d9f2f09-12da-440b-a4fd-c209da6fb41a","title":"GHSA-26p8-2jq9-3vq9: MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules","summary":"MLflow 3.12.0 added registration and deserialization support for third-party scorers. On the default no-auth server, an unauthenticated HTTP caller can chain experiment, run, and artifact-upload endpoints with the scorer invoke endpoint to import an uploaded Python module and run arbitrary code with the privileges of the MLflow server process. The official v3.14.0 image runs that process as uid 0.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","publishedAt":"2026-10-27T21:26:32.000Z","cveId":"CVE-2026-116692","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@>= 3.12.0rc0, < 3.17.0 (fixed: 3.17.0)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow","MLflow 3.12.0","MLflow 3.14.0"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-28T00:05:48.691Z","kevDateAdded":null,"advisoryAliases":["GHSA-26p8-2jq9-3vq9"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-27T21:26:32.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}