CVE-2026-115886

The record

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission. This issue is fixed in version 3.17.0.

Affected packages

Related vulnerabilities

• CVE-2026-119578 MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg… CWE-470
• CVE-2026-108097 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CWE-470
• CVE-2026-108099 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CWE-470
• CVE-2026-119050 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that… CWE-470
• CVE-2026-116692 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-470
• CVE-2026-115931 Postiz lets a signed-in user ask the backend to run a function on one of their connected… CWE-470
• CVE-2026-115749 hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an… CWE-470
• CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in… CWE-470