CVE-2026-116692

How CVE-2026-116692 works. MLflow 3.12.0 added support for third-party scorers (evaluation plugins) from four allowed packages, ragas, deepeval, trulens and phoenix, and checked only that a requested module name started with one of those package names. Per the advisory, a caller can create an experiment whose artifact location points inside one of those package folders, create a run, upload a Python file as a run artifact, then call /ajax-api/3.0/mlflow/scorer/invoke. MLflow imports the uploaded file and runs its code inside the server process before checking anything else. The advisory reproduced this on the official ghcr.io/mlflow/mlflow:v3.14.0 image, which runs as root and can write to its own installed packages.

How CVE-2026-116690 works. A prompt-tagged model version can be created with a relative path such as ../../../tmp as its source, and /api/2.0/mlflow/model-versions/get-artifact then serves files from that location with the server's permissions. The advisory lists /etc/passwd, MLflow's SQLite databases (including the basic-auth user database with the admin password hash) and shell history as confirmed read targets.

Who needs credentials. On a server without authentication, the mlflow server default, neither flaw needs credentials. With basic auth on, CVE-2026-116692 needs an account that can create an experiment and run and upload artifacts, and CVE-2026-116690 needs an account that can create a registered model. MLflow's docs list Create Experiment and Create Registered Model as requiring no specific permission, so any signed-in user may qualify.

Checks, in order. Run these only against MLflow servers your organization owns.

1. Find MLflow servers and their version. On each host or image, run mlflow --version or pip show mlflow. 3.12.0rc0 up to (not including) 3.17.0 is affected by CVE-2026-116692; 3.10.0 up to 3.17.0 by CVE-2026-116690. Search container registries and Helm values for ghcr.io/mlflow/mlflow tags in those ranges. From the network side, curl -s http://<host>:5000/version returns the server version and /health confirms an MLflow server is answering; these routes come from MLflow's source, and neither request changes anything.
2. Check network exposure. The default binds port 5000 to 127.0.0.1, but containers and many deployments start with --host 0.0.0.0. Check whether the port is reachable from the internet, user networks or other workloads, and check reverse proxies, ingress controllers and load balancers that publish MLflow on 80 or 443. A --static-prefix moves every path under a prefix.
3. Check whether authentication is on. Look at the start command or container args for --app-name basic-auth or a custom app. If it's missing, anyone who can reach the port can use both flaws. A harmless test from an untrusted network position: if curl -s -o /dev/null -w "%{http_code}" http://<host>:5000/api/2.0/mlflow/experiments/search?max_results=1 returns 200 instead of 401, the API is open.
4. Check package-directory permissions (CVE-2026-116692). The chain needs a file-backed artifact location that resolves inside an installed scorer package, so the service user must be able to write there. Run python -c "import mlflow, os; print(os.path.dirname(mlflow.__file__))" as the service user and check whether it can write to mlflow/genai/scorers/ and its ragas, deepeval, trulens and phoenix subfolders. Check whether the process runs as root and whether the container root filesystem is read-only. Per the advisory, a read-only filesystem or a package directory owned by a different user blocks this exact chain.
5. Check who can create things (authenticated servers). List users who can create experiments, runs and artifacts, and registered models. Review default_permission in the basic-auth configuration and any role grants. Each of those identities is a path in until you upgrade.
6. Check what the server can read (CVE-2026-116690). The basic_auth.db user database, tracking databases, cloud credentials, environment files and mounted secrets. That list sets how urgent the fix is per server.

These reduce exposure while you schedule the 3.17.0 upgrade. Test each one against your own server from the network positions that matter.

• Restrict network access. Allow the MLflow port only from the hosts and networks that need it, and take any internet-facing server off the internet first.
• Turn on authentication. Start with --app-name basic-auth, set MLFLOW_FLASK_SERVER_SECRET_KEY and a strong MLFLOW_AUTH_ADMIN_PASSWORD, and tighten default_permission. This narrows exposure from anyone to any user who can create experiments or models; it doesn't close it.
• Block the two endpoints at the proxy or WAF. Deny any path ending in /mlflow/scorer/invoke and any path ending in model-versions/get-artifact (MLflow serves it under /api/2.0/mlflow/, /ajax-api/2.0/mlflow/ and the bare route, per MLflow's source). Match after any static prefix. Expect side effects: blocking scorer/invoke stops on-demand GenAI scoring, and blocking get-artifact stops model version artifact downloads through the server.
• Run as non-root with a read-only package directory. Set a non-root runAsUser, a read-only root filesystem, and a site-packages owner different from the service user. Per the advisory this blocks the exact CVE-2026-116692 chain. It does nothing for CVE-2026-116690.
• Watch the process. EDR or process monitoring on the MLflow server for spawned shells or unexpected child processes, and for new .py files under site-packages/mlflow/genai/scorers/.
• Rotate what the server could read. If an affected server was reachable without authentication, plan to rotate basic-auth passwords and any cloud or database keys on disk or in its environment.

• Calls to scorer/invoke, especially from sources that don't normally use GenAI evaluation, and especially ones returning HTTP 500 (the public PoC's invoke step returns 500 after its code has already run).
• experiments/create requests whose artifact_location points into site-packages or a file:// path outside your normal artifact root.
• model-versions/create requests carrying the mlflow.prompt.is_prompt tag with a relative source such as ../, followed by model-versions/get-artifact calls.
• Experiment and registered-model names you don't recognize.

Is my MLflow server vulnerable to CVE-2026-116692?

It is if it runs MLflow 3.12.0rc0 up to 3.17.0, a caller can reach it over the network, and either authentication is off or the caller has an account that can create experiments and upload artifacts. The exact chain also needs the server process to be able to write to its scorer package directory, which was true in the official v3.14.0 image the advisory tested.

Is CVE-2026-116692 being exploited?

No reports as of October 28, 2026, and it isn't on CISA KEV. A harmless public proof of concept is in the GitHub advisory. For the related file-read flaw CVE-2026-116690, Previdian reports exploitation attempts against its honeypots; MLflow and CISA haven't confirmed that, and CISA's SSVC entry on NVD records exploitation as none.

Does turning on MLflow authentication fix it?

No. It removes unauthenticated access, but any user who can create an experiment and upload artifacts can still use CVE-2026-116692, and any user who can create a registered model can still use CVE-2026-116690. Upgrading to 3.17.0 is the fix.

Is this the MLflow flaw on CISA's exploited list?

No. That's CVE-2026-64849, a server-side request forgery flaw added to KEV on August 19, 2026. This advisory covers CVE-2026-116692 and CVE-2026-116690, both fixed in 3.17.0.

What's the difference between CVE-2026-116692 and CVE-2026-116690?

CVE-2026-116692 (9.8) lets a caller run code on the server through the scorer invoke endpoint. CVE-2026-116690 (7.5) lets a caller read files the server can read through the model version get-artifact endpoint. They affect slightly different ranges (3.12.0rc0 and 3.10.0 onward) and both are fixed in 3.17.0.

Oct 28, 2026. First published. No exploitation of CVE-2026-116692 reported; not on CISA KEV.

• MLflow advisory GHSA-26p8-2jq9-3vq9 (CVE-2026-116692)
• MLflow advisory GHSA-m65p-9j7q-6w33 (CVE-2026-116690)
• MLflow 3.17.0 release notes
• NIST NVD: CVE-2026-116692 and CVE-2026-116690
• CISA Known Exploited Vulnerabilities catalog (checked catalog version 2026.10.27)
• MLflow docs, basic HTTP authentication and CLI reference
• Previdian exploited vulnerabilities feed (third-party claim for CVE-2026-116690, unconfirmed)