GHSA-26p8-2jq9-3vq9: MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

Summary

MLflow 3.12.0 added registration and deserialization support for third-party scorers. On the default no-auth server, an unauthenticated HTTP caller can chain experiment, run, and artifact-upload endpoints with the scorer invoke endpoint to import an uploaded Python module and run arbitrary code with the privileges of the MLflow server process. The official v3.14.0 image runs that process as uid 0.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Related items

• HighGHSA-m65p-9j7q-6w33: MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version sourceSimilar attack · GitHub Advisory Database
• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSimilar attack · GitHub Advisory Database
• MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSimilar attack · GitHub Advisory Database
• MediumGHSA-rwrf-2pqf-9j8j: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasSimilar attack · GitHub Advisory Database
• MediumCyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan TargetsSimilar attack · The Hacker News