External risk intelligence

MLflow GenAI Scorer Deserialization Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-116692

MLflow is commonly deployed as an internet-facing or internal network-accessible web service for managing machine learning models and experiments. The vulnerable endpoint, /ajax-api/3.0/mlflow/scorer/invoke, is part of the application's API surface, making it reachable in deployments where the MLflow server is exposed to users or integrated into external-facing AI engineering workflows.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in MLflow, an AI engineering platform, that could allow for unauthorized code execution through its third-party scorer functionality. This issue affects specific versions of MLflow and can be exploited by placing a malicious Python module within an allowed package, which is then imported and executed by the scorer.

Malicious code execution risk in MLflow platform.
Critical for AI platforms managing models and experiments.
Confirm relevance and ensure MLflow instances are updated.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by placing a malicious Python module in a writable artifact location within MLflow. By then invoking a specific API endpoint with crafted JSON data, the attacker can cause MLflow to import and execute code from this module, potentially leading to system compromise. This attack is possible even in deployments without authentication, and in authenticated environments, an attacker with privileges to upload artifacts can achieve the same outcome.

Unauthenticated or authenticated access
Invoking the scorer invoke API
Arbitrary code execution

Live Threat

Current exploitation, exposure, and threat context

MLflow deployments with writable scorer packages could allow an attacker to execute arbitrary code. This vulnerability affects the MLflow AI engineering platform, specifically when handling third-party scorer deserialization. Unauthenticated access is possible, while authenticated access requires privileges to upload artifacts.

Arbitrary code execution.
Via crafted MLflow artifact uploads.
Compromise of the MLflow service.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners are responsible for managing MLflow deployments. The first step is to identify all MLflow instances, determine their reachability and business criticality, and locate the accountable owner to plan remediation.

Application owners should manage the issue.
Verify MLflow instance reachability and criticality.
Plan remediation based on risk exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MLflow?

MLflow is an open-source platform designed for AI engineering, specifically for managing the lifecycle of machine learning models, experiments, and LLM-based agents. Engineers use it to track model development, package code for reproducible runs, and deploy models as services. Because it sits at the intersection of data workflows and application hosting, it often manages complex artifact storage and serves as a central hub for machine learning pipelines within an organization.

What is the vulnerability in CVE-2026-116692?

This CVE involves Improper Control of Generation of Code and Use of Externally-Controlled Input to Select Classes or Code. In plain terms, the platform's third-party scorer component is too permissive when deciding which code to load. Instead of strictly requiring an exact authorized module, it accepts descendants, allowing an attacker to submit a crafted module that the system then incorrectly imports and executes as if it were a legitimate trusted scorer.

How does an attacker trigger this code execution?

An attacker needs to be able to upload a Python module to a location the server can access as a writable artifact. Once the module is placed, they invoke the scorer API with JSON data specifying that module and class. The system then automatically imports and executes this code. Note that simply having access to the API is not enough; the attacker must be able to introduce the malicious file into a directory where the scorer expects to find its allowed packages.

Why should I care if my MLflow instance is internet-facing?

Halo Surface Signal indicates that MLflow is frequently deployed as a network-accessible service. If your instance is exposed to the internet or wide internal networks, it increases the likelihood that an attacker could reach the vulnerable scorer API endpoint without prior authentication. Even in private environments, the critical nature of these AI workflows makes them high-value targets, so reachability determines how quickly you must prioritize your update.

What is the first step to secure my MLflow deployment?

The most effective response is to update your MLflow installation to version 3.17.0 or later, which contains the fix for this deserialization flaw. Before applying the patch, identify all active instances within your environment to understand which are reachable by users. Coordinate with the specific owners of those instances to verify their current version and schedule the necessary upgrade to close the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.