Database/AI/ML frameworks & serving
MLflow: a crafted model artifact runs arbitrary code when the model is loaded
Impact
Loading a model artifact in MLflow executes code the artifact carries, so whoever can put an artifact where MLflow will load it gets code execution as the process that loads it. On a GPU fleet that process is usually a training job or a serving container with the GPUs attached and with credentials for the tracking server and the artifact store, which turns one poisoned model into a foothold on the node and in the model registry. The advisory states every version from 0.0.1 onward is affected, so this is a property of how artifacts are loaded, not a regression in a recent release. Scoring puts the impact inside the loading process (SC:N/SI:N/SA:N) and requires user interaction, meaning someone has to load the model.
Who can reach it
Anyone who can get a model artifact into a path or registry that a user or job will load - a low-privileged tracking-server user, a contributor to a shared registry, or an external model pulled from a hub. Requires the victim to load the model (CVSS UI:P), and requires some privilege on the platform (PR:L), not anonymous network access.
What to do
The record names no fixed version - all versions from 0.0.1 are listed as affected - so read the HiddenLayer advisory before promising a patch to anyone. What is actionable now: treat model artifacts as executable code, restrict who can write to the tracking server and artifact store, load third-party models only in a sandbox without GPU-adjacent credentials, and stop loading untrusted artifacts inside training or serving containers that hold fleet secrets.
References
Related entries
- Vocos: model config can name any importable class, so from_pretrained runs the repo owner's codeCVE-2026-79784 · Vocos (instantiate_class in vocos/pretrained.py)High
- iFlytek astron-agent: copyFlow lacks an ownership check, letting any tenant read or overwrite workflowsCVE-2026-82475 · iFlytek astron-agent (console backend copyFlow workflow endpoint)High
- Kubeflow Pipelines: unvalidated S3/MinIO endpoint in the UI proxy allows unauthenticated SSRFCVE-2026-88981 · Kubeflow Pipelines ml-pipeline-ui (artifact download and archived pod-log endpoints)High
- Unsloth Zoo: model config.json injects Python that runs via exec() when a model is loadedCVE-2026-93348 · Unsloth / Unsloth Zoo (get_transformers_model_type model-loading compile path)High
- Ollama: agent-mode Bash approval does not parse shell syntax, so appended commands run unapprovedCVE-2026-102697 · Ollama experimental agent mode (Bash tool approval parser, x/agent/approval.go)High
- AWS databases-on-aws agent plugin: crafted database command in agent context runs OS commands on the hostCVE-2026-107322 · Amazon Agent Plugins for AWS, databases-on-aws plugin (agent command helper)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.