MLflow CVE-2026-116692 (GHSA-26p8-2jq9-3vq9, CVSS 9.8): remote code execution on tracking servers through third-party scorer deserialization, plus a related SSRF (CVE-2026-115886). Which versions are affected and how do I fix it?

What it is: MLflow 3.12 added server-side 'scorers' for GenAI evaluation. GitHub advisory GHSA-26p8-2jq9-3vq9 (CVE-2026-116692, published October 27, 2026) reports that the scorer endpoints can be made to import and run Python code that a caller placed on the server as an uploaded artifact. On a tracking server with authentication off (the default), anyone who can reach it over the network can run code as the MLflow server process. With basic auth on, any logged-in user who can create runs and upload artifacts can do the same, because the scorer endpoint has no per-resource permission check. A related medium advisory, GHSA-2wqp-q3c6-ccj5 (CVE-2026-115886), lets the same scorer endpoints be used to make the server send requests to other addresses (SSRF). No exploitation was reported at publication, but MLflow servers are often exposed and an earlier MLflow SSRF was exploited within hours in August 2026. Am I affected: - mlflow (and mlflow-skinny) 3.12.0rc0 up to, but not including, 3.17.0, running as a tracking server (mlflow server / mlflow ui, or the official Docker image). Check with pip show mlflow or the version in the UI. - Highest risk: servers with no authentication reachable beyond localhost, and containers running as root. Code execution needs the server process to be able to write into its own Python package directories, so a read-only install blocks the RCE part. - MLflow 3.11 and earlier don't have the scorer feature. Fix: 1. Upgrade to mlflow 3.17.0 or later (pip install -U mlflow, or the 3.17.0+ image) and restart the server. This fixes both advisories. 2. Until you can: don't expose the tracking server to the internet or untrusted networks; put it behind authentication and a reverse proxy; allow only trusted users to create experiments and upload artifacts. 3. Harden the deployment: run as a non-root user, keep the Python environment read-only to the server process (or owned by another user), and use a read-only container filesystem where you can. Limit the server's outbound network access, especially to cloud metadata addresses such as 169.254.169.254. 4. If an unauthenticated server on an affected version was reachable from untrusted networks, check for unexpected experiments, runs and artifact uploads and new .py files under the MLflow package directories, and rotate cloud and database credentials the server could use. Verify: pip show mlflow (or the UI) shows 3.17.0 or later, and the server isn't reachable without authentication from outside your network. Sources: https://github.com/advisories/GHSA-26p8-2jq9-3vq9 https://github.com/mlflow/mlflow/releases/tag/v3.17.0 https://github.com/advisories/GHSA-2wqp-q3c6-ccj5 https://www.mend.io/vulnerability-database/WS-2026-0135/