MLflow 3.12 to 3.16 servers: critical unauthenticated remote code execution through third-party scorer deserialization (GHSA-26p8-2jq9-3vq9, CVSS 9.8); fixed in MLflow 3.17.0

MLflow published security advisory GHSA-26p8-2jq9-3vq9 on 9 October 2026, rated Critical (CVSS 3.1 9.8), for a remote code execution flaw in the open-source MLflow tracking server. Support for third-party scorers, added in MLflow 3.12.0, lets the server import a Python module named in a request as long as the module path starts with one of four allowed scorer package names (ragas, deepeval, trulens, phoenix), then build a class from it. An HTTP caller can chain this with MLflow's normal experiment, run and artifact-upload endpoints: create an experiment whose local artifact location points inside an allowed scorer package, create a run, upload a Python file as a run artifact, and then ask the scorer-invoke endpoint (/ajax-api/3.0/mlflow/scorer/invoke) to load it. The code runs in the MLflow server process before any trace checks. On a default server with no authentication, such as the official MLflow container image the reporter tested (v3.14.0, which ran as root), this gives any network caller arbitrary code execution and access to the data, credentials and models the server can reach. With MLflow basic authentication turned on, a login is still needed, but the scorer endpoint does no per-experiment permission check. The advisory lists affected versions as 3.12.0 up to but not including 3.17.0 and the fix as 3.17.0 (released 7 October); no CVE ID has been assigned. MLflow has not reported exploitation. MLflow is widely used for machine-learning experiment tracking and model registries, often exposed inside data-science networks without authentication. Primary: MLflow GitHub security advisory (9 Oct 2026).

Product

MLflow open-source tracking server (pip package mlflow and official container images)

Versions

3.12.0 up to but not including 3.17.0 (feature absent in 3.11.1 and earlier)

CVSS

9.8 (CVSS 3.1, MLflow advisory)

Exploited in Australia?

unknown

Patch to

Upgrade MLflow to 3.17.0 or later (latest 3.17.2) and rebuild any containers using older official images. Do not expose MLflow tracking servers to untrusted networks without authentication; put them behind an authenticating proxy, avoid running them as root, and make the Python package directories read-only to the server process. Review experiments with artifact locations pointing inside site-packages and unexpected .py run artifacts.

Primary: MLflow — GHSA-26p8-2jq9-3vq9: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization (9 Oct 2026) · Vendor: PyPI — mlflow (3.17.0 released 7 Oct 2026; latest 3.17.2)

tech ai cloud