MLflow: request-selected scorer module import allows remote code execution on the tracking server

Impact

MLflow's third-party scorer path accepts any descendant of an allowed module rather than an exact match, so a caller who can write an artifact beneath a writable allowed package can get the server to import that module and construct a class from it during Scorer.model_validate_json(). That is arbitrary code execution as the MLflow server process. On a GPU fleet the tracking server usually holds the credentials for the artifact store and the model registry, so code execution there means the attacker can read or replace the models that get served on the GPU nodes - a supply-chain foothold rather than a single compromised host. Deployments with authentication disabled need no credentials at all; with basic auth, any principal able to create an experiment and a run and upload artifacts is enough. The flaw only fires if the allowed scorer package is writable by the server process.

Who can reach it

Network access to the MLflow tracking server. No credentials on auth-disabled deployments; otherwise any authenticated principal that can create an experiment and run and upload artifacts. Requires the allowed scorer package directory to be writable by the server process.

What to do

Upgrade MLflow to 3.17.0 and restart the tracking server; affected range is 3.12.0rc0 through 3.16.x. Until then, make the scorer package directories read-only to the server process and ensure authentication is enabled with artifact upload restricted. Server restart only - no node drain needed, but anything that embedded the tracking server in a long-lived job will need recycling.

References

Related entries

• Keras (Lambda layer): Arbitrary code execution via Lambda-layer deserialization in 3.14.0CVE-2026-12481 · Keras (Lambda layer)Critical
• fickling: MLAllowlist pass never runs, so malicious pickles pass check_safety as LIKELY_SAFECVE-2026-14535 · Trail of Bits fickling (MLAllowlist analysis pass disabled by shared AnalysisContext state)Critical
• SGLang (`/load_lora_adapter_from_tensors`): Unauthenticated RCE bypassing `SafeUnpickler`'s incomplete denylistCVE-2026-15969 · SGLang (`/load_lora_adapter_from_tensors`)Critical
• vLLM (image error echo): Error path returns sensitive content on invalid image inputCVE-2026-22778 · vLLM (image error echo)Critical
• Milvus (port 9091): Management port 9091 exposed by default enabling compromiseCVE-2026-26190 · Milvus (port 9091)Critical
• SGLang (multimodal ZMQ broker): Unauthenticated RCE via `pickle.loads()` on the ZMQ brokerCVE-2026-3059 · SGLang (multimodal ZMQ broker)Critical