Database/AI/ML frameworks & serving
MLflow: a crafted model artifact runs arbitrary code when the model is loaded
Impact
Loading a model artifact in MLflow executes code the artifact carries, so whoever can put an artifact where MLflow will load it gets code execution as the process that loads it. On a GPU fleet that process is usually a training job or a serving container with the GPUs attached and with credentials for the tracking server and the artifact store, which turns one poisoned model into a foothold on the node and in the model registry. The advisory states every version from 0.0.1 onward is affected, so this is a property of how artifacts are loaded, not a regression in a recent release. Scoring puts the impact inside the loading process (SC:N/SI:N/SA:N) and requires user interaction, meaning someone has to load the model.
Who can reach it
Anyone who can get a model artifact into a path or registry that a user or job will load - a low-privileged tracking-server user, a contributor to a shared registry, or an external model pulled from a hub. Requires the victim to load the model (CVSS UI:P), and requires some privilege on the platform (PR:L), not anonymous network access.
What to do
The record names no fixed version - all versions from 0.0.1 are listed as affected - so read the HiddenLayer advisory before promising a patch to anyone. What is actionable now: treat model artifacts as executable code, restrict who can write to the tracking server and artifact store, load third-party models only in a sandbox without GPU-adjacent credentials, and stop loading untrusted artifacts inside training or serving containers that hold fleet secrets.
References
Related entries
- Vocos: model config can name any importable class, so from_pretrained runs the repo owner's codeCVE-2026-79784 · Vocos (instantiate_class in vocos/pretrained.py)High
- iFlytek astron-agent: copyFlow lacks an ownership check, letting any tenant read or overwrite workflowsCVE-2026-82475 · iFlytek astron-agent (console backend copyFlow workflow endpoint)High
- Qdrant (`/logger`): Append to arbitrary files via the logger endpointCVE-2026-25628 · Qdrant (`/logger`)High
- llama.cpp llama-server: crafted sampler parameter triggers out-of-bounds read and unauthenticated crashCVE-2026-43628 · llama.cpp llama-server (DRY sampler, /v1/completions and /v1/chat/completions)High
- NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpointsCVE-2026-65092 · NVIDIA OpenShell Sandbox for Linux (L7 REST network policy enforcement)High
- Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.