MLflow describes itself as an open source AI engineering platform for agents, large language models and machine learning models. On 27 October it got 2 CVEs, both assigned by GitHub, both fixed in 3.17.0.

Read the titles rather than the scores. One is "Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization". The other is "Arbitrary file read on unauthenticated MLflow servers via prompt model version source". The deployment state is in the title of each, which is unusual and honest, because a tracking server started the ordinary way has no authentication in front of it.

The 9.8

CVE-2026-116692 is scored 9.8, carries CWE-94 for code injection and CWE-470 for unsafe reflection, and affects 3.12.0rc0 up to 3.17.0. Third-party scorer deserialization accepts a request-selected descendant of an allowed module list rather than an exact allowed module, and the advisory states the principle plainly: "A package-name prefix is not a provenance boundary."

So an attacker uses MLflow's ordinary experiment, run and artifact-upload endpoints to place a Python module under a writable allowed package, then submits a serialized scorer that points at it. The constructor runs before the server validates trace identifiers, which means the code executes even though the request goes on to fail. No background job is needed and no special server option has to be enabled.

The advisory adds one more line worth carrying into a risk conversation: the stock image runs as uid 0.

The 7.5

CVE-2026-116690 is a path traversal, CWE-22, scored 7.5, affecting 3.10.0 up to 3.17.0. The prompt branch in the model version creation path accepts schemeless relative sources, because path validation only runs when a source carries a URL scheme, and the prompt marker is read by tag presence rather than by its value.

A remote caller stores a server-local path as a model version source and then pulls the file back through the artifact endpoint. Server-side files, read by anybody who can reach the port.

Two halves of the same door

The 2 pair naturally. One reads files from the host, which is how an attacker learns what is there. The other writes a module and gets it imported, which is how they take the host. Both travel through the same artifact endpoints the product exposes to do its job.

That is the uncomfortable part of securing this category. The endpoints are not a mistake. Storing artifacts and loading scorers is the product, and the flaws are in where the trust boundary was drawn inside features that have to exist.

It is not on the catalogue, but the product is

Neither CVE appears in CISA's Known Exploited Vulnerabilities catalogue as of version 2026.10.28. MLflow itself does: CVE-2026-64849, a server-side request forgery flaw, was added on 19 August with a due date of 2 September.

So this is a product that has already been through the catalogue once this year. Reports of attempts against the new file-read flaw have appeared within a day of publication, from a single honeypot operator, and no second source has confirmed them. That is worth knowing and not worth repeating as established.

What to do

  • Upgrade to 3.17.0. It closes both.
  • Put authentication in front of the tracking server. The default is none, and both advisory titles are about what that default costs.
  • Do not expose a tracking server to the internet. If it is reachable from outside your network, treat it as already indexed.
  • Run the container with a read-only filesystem, or make the scorer package directory owned by a user the server cannot write as. The advisory says either blocks the placement step of the RCE.
  • Stop running the stock image as uid 0.
  • Inventory where MLflow is actually running. In most organisations the answer includes machines nobody calls production.

What is not established

  • Whether either flaw has been exploited. The honeypot report is one operator's, unconfirmed, and neither CVE is on the catalogue.
  • How many tracking servers are reachable. No scan figures have been published for these flaws.
  • What the authenticated case costs an attacker. The advisory says it still needs a principal who can create experiments, runs and uploads, and that the scorer endpoint is not gated by a resource-specific permission check.
  • Whether the two flaws were found together or separately. The records credit different reporters and arrived on the same day.
  • What else sits in the same shape. Both bugs come from trusting a prefix or a tag rather than a value, which is a pattern rather than an incident.