{"id":"ghsa-ghsa-26p8-2jq9-3vq9","seq":1713812,"kind":"advisory","title":"MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules","url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","permalink":"https://vulnpulse.app/items/ghsa-ghsa-26p8-2jq9-3vq9","summary":"影響: pip:mlflow >= 3.12.0rc0, < 3.17.0 → 3.17.0\nMLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously. An HTTP caller can combine this behavior with MLflow's built-in experiment, run, and artifact-upload endpoints: 1. Create an experiment whose local artifact location…","severity":"critical","techs":["python"],"cves":["CVE-2026-116692"],"tags":["GHSA-26p8-2jq9-3vq9","mlflow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T21:26:32.000Z","fetched_at":"2026-10-27T21:27:53.142Z"}