MLflow: unauthenticated scorer/invoke deserialization lets a caller drive outbound requests to internal hosts

Impact

The scorer invoke, register and GenAI evaluate endpoints - including an unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke - deserialize third-party scorer data with a module-path allowlist that does not constrain the chosen class or its constructor arguments. Where the optional trulens and trulens-providers-litellm packages are installed, an attacker can select the trulens scorer, pick a model URI that falls through to the LiteLLM path, and set api_base and api_key so the MLflow server issues a request to a host of their choosing with attacker-controlled headers and body. That turns an experiment-tracking server, which usually sits inside the cluster with network reach to registries, object storage and cloud metadata, into a request relay. The deserialization happens before any tracking-store lookup or job submission, so no valid experiment or job is needed.

Who can reach it

Anyone who can reach the MLflow tracking server's HTTP API; the invoke endpoint requires no authentication. Exposure depends on the optional trulens packages being present in the server image.

What to do

Upgrade MLflow to 3.17.0 and restart the tracking server - a daemon restart, no node work. If you cannot upgrade immediately, remove trulens and trulens-providers-litellm from the server environment, keep the tracking server off any network path where unauthenticated clients can reach it, and block its egress to link-local metadata addresses.

References

Related entries

• vLLM: unbounded chat-template rendering lets one request wedge or exhaust the serving processCVE-2026-115911 · vLLM OpenAI-compatible server (request-supplied Jinja chat template rendering)Medium
• vLLM: Phi-4 audio encoder materializes quadratic attention matrices, letting one long clip OOM the engineCVE-2026-115913 · vLLM Phi-4 multimodal audio encoder (phi4mm_audio.py eager attention)Medium
• vLLM: an all-zero image on the DeepSeek-OCR path trips a fatal assertion and shuts the engine downCVE-2026-115914 · vLLM DeepSeek-OCR image path (_parse_and_validate_image_input / sanity_check_mm_encoder_outputs)Medium
• vLLM: off-by-one prompt-token-ID bound lets a request crash the inference engineCVE-2026-115916 · vLLM tokenizer input validation (vllm/tokenizers/hf.py max_token_id)Medium
• vLLM: request-supplied chat template bypasses trust_request_chat_template and exhausts the serverCVE-2026-115918 · vLLM /v1/responses endpoint (chat_template_kwargs trust policy)Medium
• MLflow: CrewAI autologging writes provider API keys in plaintext into tracesCVE-2026-116691 · MLflow CrewAI autologging (mlflow/crewai/autolog.py agent attribute capture)Medium