{"slug":"mlflow-cve-2026-116692","title":"MLflow RCE and file read on unauthenticated servers (CVE-2026-116692, CVE-2026-116690)","shortName":"MLflow","summary":"MLflow tracking-server flaws: CVE-2026-116692 (unauthenticated-by-default RCE through third-party scorer deserialization, GitHub CVSS 3.1 9.8) and CVE-2026-116690 (path-traversal file read, GitHub CVSS 3.1 7.5). Both fixed in 3.17.0 (PyPI 7 Oct 2026). Latest on PyPI is 3.17.2 (21 Oct 2026). Exploitation attempts are recorded for CVE-2026-116690 only (Previdian honeypots, via SecurityOnline, 28 Oct 2026). No exploitation of CVE-2026-116692 has been reported. Neither MLflow nor CISA has confirmed any. Some daily recaps (PBCS, 1 Nov 2026) overstate this as both exploited. Not in CISA KEV (catalog 2026.10.30, checked 2 Nov 2026).","isExample":false,"draft":false,"family":"mlflow-cve-2026-116692","kind":"single-product","aliases":["CVE-2026-116692","CVE-2026-116690","GHSA-26p8-2jq9-3vq9","GHSA-m65p-9j7q-6w33","MLflow"],"publishedAt":"2026-11-02","updatedAt":"2026-11-02","patchStatus":"patched","exploited":"attempts","scores":{"cve":"CVE-2026-116692","cvss":{"cve":"CVE-2026-116692","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-116692","sourceDate":"2026-10-28","checkedDate":"2026-11-02","dateLabel":"NVD lastModified; Awaiting Analysis","sourceLabel":"NVD CNA metric (GitHub; Secondary CVSS 3.1 9.8). NVD has no NVD-produced Primary metric.","nvdPublishedDate":"2026-10-27"},"epss":{"cve":"CVE-2026-116692","score":0.00704,"percentile":0.53335,"date":"2026-11-01","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116692","checkedDate":"2026-11-02"},"kev":{"cve":"CVE-2026-116692","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.10.30","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-02"},"addedDate":"2026-11-02"},"priority":{"label":"high"},"managementSummary":{"what":"MLflow tracking-server RCE (CVE-2026-116692, GitHub CVSS 3.1 9.8) and a related file-read flaw (CVE-2026-116690, 7.5). Auth is off by default. Exploitation attempts are recorded for CVE-2026-116690 only. No exploitation of CVE-2026-116692 has been reported. Neither MLflow nor CISA has confirmed any. Some daily recaps overstate this as both exploited. Not in CISA KEV (checked 2 Nov 2026). Fixed in 3.17.0.","action":"Upgrade every MLflow tracking server to 3.17.0 or later (PyPI latest 3.17.2). Do not expose an unauthenticated server. Turn on authentication with least privilege. Run the process as a non-root user with a read-only package directory. If a server was reachable while vulnerable, rotate credentials and cloud keys it could read."},"seenInTheWild":[{"metric":"third-party-stated","value":"Honeypot exploitation attempts against CVE-2026-116690 within a day of 27 Oct 2026","observer":"Previdian (via SecurityOnline)","date":"2026-10-27","method":"SecurityOnline (28 Oct 2026) quotes Previdian honeypots capturing exploitation attempts targeting CVE-2026-116690 within a day of the 27 Oct 2026 CVE publication. Previdian's own CVE page (opened 2 Nov 2026) says first observed 27 Oct 2026, last observed 1 Nov 2026, 122 attempts from 13 unique attacker IPs. Attempts only. Not a compromise claim. Previdian names CVE-2026-116690, not CVE-2026-116692. Neither MLflow nor CISA has confirmed any.","sourceUrl":"https://securityonline.info/mlflow-vulnerability-exploited-poc/"},{"metric":"third-party-stated","value":"No exploitation of CVE-2026-116692 reported as of 28 Oct 2026","observer":"Tuskira","date":"2026-10-28","method":"Tuskira (28 Oct 2026): no exploitation of CVE-2026-116692 reported; neither CVE is on CISA KEV. For CVE-2026-116690, Tuskira cites Previdian honeypot attempts and notes that MLflow and CISA have not confirmed them. CISA SSVC on the NVD record for CVE-2026-116690 records exploitation: none (28 Oct 2026 15:54 UTC).","sourceUrl":"https://www.tuskira.ai/advisories/cve-2026-116692"}],"seenInTheWildLinks":[{"title":"MLflow Vulnerability CVE-2026-116690 Exploited in the Wild as PoC Details Go Public (headline; Previdian honeypot attempts on CVE-2026-116690 only)","url":"https://securityonline.info/mlflow-vulnerability-exploited-poc/","observer":"SecurityOnline","metric":"third-party-stated"},{"title":"Previdian: CVE-2026-116690 Exploitation Attempts Observed","url":"https://previdian.com/CVE-2026-116690","observer":"Previdian","metric":"third-party-stated"},{"title":"Tuskira: CVE-2026-116692 (28 Oct 2026)","url":"https://www.tuskira.ai/advisories/cve-2026-116692","observer":"Tuskira","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-02","items":[{"text":"New catalog page for MLflow CVE-2026-116692 (RCE) and CVE-2026-116690 (file read).","headline":"New catalog page for MLflow CVE-2026-116692 and CVE-2026-116690","section":"overview","date":"2026-11-02","kind":"page"},{"text":"Previdian honeypots recorded exploitation attempts against CVE-2026-116690, first observed 27 Oct 2026 (SecurityOnline 28 Oct 2026; Previdian page opened 2 Nov 2026). Attempts only; not a compromise claim. No exploitation of CVE-2026-116692 has been reported. Neither MLflow nor CISA has confirmed any. Some daily recaps (PBCS, 1 Nov 2026) overstate this as both exploited. Not in CISA KEV (catalog 2026.10.30, checked 2 Nov 2026).","headline":"Previdian attempts on CVE-2026-116690; not a compromise claim; some recaps overstate both","section":"exploitation","date":"2026-11-02","sourceUrl":"https://securityonline.info/mlflow-vulnerability-exploited-poc/","alsoSourceUrl":"https://www.pbcsnyc.com/post/daily-cybersecurity-briefing-november-1-2026"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-11-02","kind":"page"}]},"whatTheBugIs":"CVE-2026-116692 is remote code execution on MLflow tracking servers that run without authentication by default, through third-party scorer deserialization that imports caller-placed code. A related flaw, CVE-2026-116690, is a path-traversal file read through prompt model version sources. GitHub scores the RCE CVSS 3.1 9.8 (CWE-94, CWE-470) and the file read 7.5 (CWE-22). Both are fixed in MLflow 3.17.0. Some daily recaps (PBCS, 1 Nov 2026) overstate this pair as both exploited. This page records sourced attempts against CVE-2026-116690 only. No exploitation of CVE-2026-116692 has been reported. Neither MLflow nor CISA has confirmed any. Not in CISA KEV (catalog 2026.10.30, checked 2 Nov 2026). CVE-2026-64849 is a different MLflow bug (SSRF) that CISA listed on 19 Aug 2026; do not treat that listing as these two CVEs.\n\nNVD republishes the GitHub CNA records (checked 2 Nov 2026). CVE-2026-116692 was published 27 Oct 2026 21:18 UTC, lastModified 28 Oct 2026, status Awaiting Analysis, Secondary CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CVE-2026-116690 was published 27 Oct 2026 20:17 UTC, lastModified 28 Oct 2026, status Awaiting Analysis, Secondary CVSS 3.1 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). NVD has no NVD-produced Primary metric on either record. The CVE-2026-116690 record includes a CISA Coordinator SSVC option exploitation: none dated 28 Oct 2026 15:54 UTC; that is not a KEV listing. The CVE-2026-116692 NVD record we opened has no SSVC block.\n\nGitHub Advisory Database GHSA-26p8-2jq9-3vq9 (published 27 Oct 2026 21:26:32 UTC, reporter mskca) describes the RCE: third-party scorer support, added in MLflow 3.12.0, accepts a request-selected descendant of an allowed package prefix, then imports that module and constructs a class on the server. A package-name prefix is not a provenance boundary. A caller can use ordinary tracking endpoints so that a later request to /ajax-api/3.0/mlflow/scorer/invoke makes the server import attacker-placed code. The advisory reproduced this on the official MLflow v3.14.0 image, which ran as uid 0 and could write its installed package tree. With authentication off (the default mlflow server configuration), no credentials are required. With basic auth on, the caller still needs a principal that can create an experiment and run and upload artifacts, and the scorer package path must be writable. A read-only filesystem or a package directory the service user cannot write blocks that exact chain. This page does not name modules, request bodies, or upload steps.\n\nGitHub Advisory Database GHSA-m65p-9j7q-6w33 (published 27 Oct 2026 21:26:56 UTC, reporter mskca) describes the file read: a prompt-tagged model version can store a schemeless local source, and a later registry get-artifact request serves files the server process can read. Affected 3.10.0 through 3.16.1, fixed in 3.17.0 by mlflow/mlflow#25870 (merged 16 Sep 2026). Default unauthenticated servers need no privileges. On basic-auth servers, any user who can create a registered model can use the path; the advisory says a low-privilege account can read the authentication database, including the admin password hash. Registry endpoints must be reachable. This page does not republish request bodies or source values.\n\nPyPI received mlflow 3.17.0 at 7 Oct 2026 06:07:39 UTC and 3.17.2 at 21 Oct 2026 02:08:42 UTC (opened 2 Nov 2026). mlflow/mlflow#25906 (Match third-party scorer modules exactly instead of by package prefix) merged 16 Sep 2026 15:53:39 UTC. GHSA-26p8-2jq9-3vq9 lists it as a fix reference. The same two advisories were first published to mlflow/mlflow on 9 Oct 2026 08:20:37 UTC (GHSA-26p8-2jq9-3vq9) and 13 Oct 2026 05:56:11 UTC (GHSA-m65p-9j7q-6w33).\n\nExploitation status: Previdian honeypots recorded attempts against CVE-2026-116690, first observed 27 Oct 2026 (SecurityOnline 28 Oct 2026; Previdian page opened 2 Nov 2026, 122 attempts, last observed 1 Nov 2026). Tuskira (28 Oct 2026) and Root Notes (29 Oct 2026) treat that as a single-operator honeypot report, unconfirmed. No source we opened reports exploitation of CVE-2026-116692. Neither MLflow nor CISA has confirmed any. PBCS (1 Nov 2026) wrote that both are actively exploited in the wild; that overstates the sourced record.","attackPath":{"caption":"High-level only. Not a reproduction guide. A related path reads local files through the registry. No module names, request bodies, or upload steps.","steps":[{"id":"internet","label":"Reachable tracking server","detail":"Network access to an MLflow tracking server. GHSA: mlflow server runs without authentication by default."},{"id":"app","label":"Tracking or registry request","detail":"A request reaches ordinary tracking or model-registry endpoints. Conceptual impact class only."},{"id":"unsafe","label":"Server imports caller-placed code","detail":"GHSA-26p8-2jq9-3vq9: a later request makes the server import attacker-placed code through third-party scorer deserialization. Related GHSA-m65p-9j7q-6w33: the registry can serve a local file."},{"id":"exec","label":"Python as the MLflow process","detail":"Code runs with the privileges of the MLflow server process. The official v3.14.0 image the advisory tested ran as uid 0."},{"id":"shell","label":"Host, files, and keys","detail":"Impact follows what that process can read or run: tracking data, credentials, and the host. File-read targets include the authentication database."}]},"exploitation":{"kev":{"listed":false,"date":"2026-10-30","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 2 Nov 2026) against catalog 2026.10.30 (released 2026-10-30T17:02:45.3665Z, 1,766 entries). CVE-2026-116692 and CVE-2026-116690 are not listed. CVE-2026-64849 is a different MLflow bug (SSRF) listed 19 Aug 2026; do not treat that listing as these two CVEs. The NVD record for CVE-2026-116690 includes a CISA Coordinator SSVC option exploitation: none dated 28 Oct 2026; that is not a KEV listing."},"firstSeen":{"date":"2026-10-27","source":"Previdian (via SecurityOnline, 28 Oct 2026)","note":"Previdian honeypots recorded exploitation attempts against CVE-2026-116690, first observed 27 Oct 2026 (SecurityOnline 28 Oct 2026; Previdian page opened 2 Nov 2026). Attempts only. No exploitation of CVE-2026-116692 has been reported. Neither MLflow nor CISA has confirmed any. Some daily recaps (PBCS, 1 Nov 2026) overstate this as both exploited. Not in CISA KEV (checked 2 Nov 2026). First calendar day of successful compromise: not verified.","dateLabel":"Attempts"},"vendorStatements":[]},"timeline":[{"date":"2026-09-16T03:20:40Z","event":"mlflow/mlflow#25870 merged. It rejects schemeless path sources for prompt model versions. GHSA-m65p-9j7q-6w33 names this pull request as the CVE-2026-116690 fix shipped in 3.17.0.","source":{"title":"Reject schemeless path sources for prompt model versions","url":"https://github.com/mlflow/mlflow/pull/25870","publisher":"MLflow"},"kind":"patch","addedDate":"2026-11-02"},{"date":"2026-09-16T15:53:39Z","event":"mlflow/mlflow#25906 merged at 15:53:39 UTC. Title: Match third-party scorer modules exactly instead of by package prefix. GHSA-26p8-2jq9-3vq9 names this pull request as a CVE-2026-116692 fix reference.","source":{"title":"Match third-party scorer modules exactly instead of by package prefix","url":"https://github.com/mlflow/mlflow/pull/25906","publisher":"MLflow"},"kind":"patch","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-07T06:07:39Z","event":"PyPI received mlflow 3.17.0 at 06:07:39 UTC. Both GitHub advisories name 3.17.0 as the first fixed release for CVE-2026-116692 and CVE-2026-116690.","source":{"title":"mlflow 3.17.0 on PyPI","url":"https://pypi.org/project/mlflow/3.17.0/","publisher":"PyPI"},"kind":"patch","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-09T08:20:37Z","event":"mlflow/mlflow published repository advisory GHSA-26p8-2jq9-3vq9 (CVE-2026-116692) at 08:20:37 UTC. Reporter: mskca. The body includes a proof of concept. This site links the advisory only and does not copy code.","source":{"title":"GHSA-26p8-2jq9-3vq9","url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9","publisher":"MLflow"},"kind":"advisory","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-13T05:56:11Z","event":"mlflow/mlflow published repository advisory GHSA-m65p-9j7q-6w33 (CVE-2026-116690) at 05:56:11 UTC. Reporter: mskca. The body includes a proof of concept. This site links the advisory only and does not copy code.","source":{"title":"GHSA-m65p-9j7q-6w33","url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-m65p-9j7q-6w33","publisher":"MLflow"},"kind":"advisory","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-21T02:08:42Z","event":"PyPI received mlflow 3.17.2 at 02:08:42 UTC. Latest stable on PyPI when this page was written (opened 2 Nov 2026).","source":{"title":"mlflow 3.17.2 on PyPI","url":"https://pypi.org/project/mlflow/3.17.2/","publisher":"PyPI"},"kind":"patch","addedDate":"2026-11-02"},{"date":"2026-10-27T20:17:14.340Z","event":"NVD published CVE-2026-116690 at 20:17 UTC. Status when we opened the record on 2 Nov 2026: Awaiting Analysis. CNA GitHub metric on that record is CVSS 3.1 7.5.","source":{"title":"NVD - CVE-2026-116690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116690","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-11-02"},{"date":"2026-10-27T21:18:05.013Z","event":"NVD published CVE-2026-116692 at 21:18 UTC. Status when we opened the record on 2 Nov 2026: Awaiting Analysis. CNA GitHub metric on that record is CVSS 3.1 9.8.","source":{"title":"NVD - CVE-2026-116692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116692","publisher":"NVD"},"kind":"disclosure","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-27T21:26:32Z","event":"GitHub Advisory Database published GHSA-26p8-2jq9-3vq9 (CVE-2026-116692) at 21:26:32 UTC. Reporter: mskca. The advisory includes a proof of concept. This site links the advisory only and does not copy code.","source":{"title":"GHSA-26p8-2jq9-3vq9","url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","publisher":"GitHub Advisory Database"},"kind":"advisory","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-27T21:26:56Z","event":"GitHub Advisory Database published GHSA-m65p-9j7q-6w33 (CVE-2026-116690) at 21:26:56 UTC. Reporter: mskca. The advisory includes a proof of concept. This site links the advisory only and does not copy code.","source":{"title":"GHSA-m65p-9j7q-6w33","url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","publisher":"GitHub Advisory Database"},"kind":"advisory","addedDate":"2026-11-02"},{"id":"exploitation-attempts","date":"2026-10-27","event":"Previdian honeypots recorded exploitation attempts against CVE-2026-116690, first observed 27 Oct 2026. SecurityOnline published the recap on 28 Oct 2026. Attempts only. No exploitation of CVE-2026-116692 has been reported.","source":{"title":"MLflow Vulnerability CVE-2026-116690 Exploited in the Wild as PoC Details Go Public (headline; Previdian honeypot attempts on CVE-2026-116690 only)","url":"https://securityonline.info/mlflow-vulnerability-exploited-poc/","publisher":"SecurityOnline"},"kind":"other","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-28","event":"Tuskira published a defender advisory: no exploitation of CVE-2026-116692 reported; neither CVE on CISA KEV; Previdian attempts on CVE-2026-116690 unconfirmed by MLflow or CISA. CISA SSVC on the NVD record for CVE-2026-116690 records exploitation: none.","source":{"title":"CVE-2026-116692 MLflow: is it reachable in your environment?","url":"https://www.tuskira.ai/advisories/cve-2026-116692","publisher":"Tuskira"},"kind":"advisory","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-29","event":"Root Notes: neither CVE is in CISA KEV as of catalog 2026.10.28; the honeypot report is one operator's, unconfirmed. CVE-2026-64849 is a different MLflow bug already on the catalog.","source":{"title":"Two MLflow flaws whose titles name the deployment state","url":"https://rootnotes.in/article/mlflow-two-flaws-whose-titles-name-the-deployment-state","publisher":"Root Notes"},"kind":"advisory","addedDate":"2026-11-02"},{"date":"2026-11-01","event":"PBCS daily briefing wrote that CVE-2026-116690 and CVE-2026-116692 are both actively exploited in the wild. That overstates the sourced record: attempts are reported for CVE-2026-116690 only, and neither MLflow nor CISA has confirmed any.","source":{"title":"Daily Cybersecurity Briefing, 1 Nov 2026","url":"https://www.pbcsnyc.com/post/daily-cybersecurity-briefing-november-1-2026","publisher":"PBCS"},"kind":"other","addedDate":"2026-11-02"},{"date":"2026-11-02","event":"Still not in CISA KEV. Checked catalog 2026.10.30 (released 2026-10-30T17:02:45.3665Z, 1,766 entries). CVE-2026-116692 and CVE-2026-116690 are not listed.","source":{"title":"CISA Known Exploited Vulnerabilities catalog JSON","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-02"}],"openNotes":[{"title":"In-the-wild status is attempts on CVE-2026-116690 only","detail":"Previdian reported honeypot attempts against CVE-2026-116690, first observed 27 Oct 2026. That is a third-party honeypot report. No source we opened reports exploitation of CVE-2026-116692. Neither MLflow nor CISA has confirmed any. Some daily recaps (PBCS, 1 Nov 2026) overstate this as both exploited. Independent validation of successful compromise: not verified.","sources":[{"url":"https://securityonline.info/mlflow-vulnerability-exploited-poc/","date":"2026-10-28","publisher":"SecurityOnline"},{"url":"https://previdian.com/CVE-2026-116690","date":"2026-10-27","publisher":"Previdian"},{"url":"https://www.pbcsnyc.com/post/daily-cybersecurity-briefing-november-1-2026","date":"2026-11-01","publisher":"PBCS"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-30","publisher":"CISA"}]},{"title":"Repository advisories published 9 Oct and 13 Oct 2026","detail":"mlflow/mlflow published GHSA-26p8-2jq9-3vq9 on 9 Oct 2026 08:20:37 UTC and GHSA-m65p-9j7q-6w33 on 13 Oct 2026 05:56:11 UTC (repository advisory published_at, checked 1 Nov 2026). Both bodies include the reporter (mskca) proof of concept. The GitHub Advisory Database records list published_at 27 Oct 2026 21:26 UTC for both GHSAs.","sources":[{"url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-09","publisher":"MLflow"},{"url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-13","publisher":"MLflow"},{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"}]},{"title":"CVE-2026-64849 is a different bug","detail":"CISA listed CVE-2026-64849, an MLflow server-side request forgery flaw, on 19 Aug 2026. That is a different bug from CVE-2026-116692 and CVE-2026-116690.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog","date":"2026-08-19","publisher":"CISA"}]},{"title":"GHSA-26p8 body still says no fixed release as of 12 Jul 2026","detail":"The GHSA-26p8-2jq9-3vq9 body still says \"No fixed release was identified as of 2026-07-12.\" Its advisory metadata and the NVD record for CVE-2026-116692 name 3.17.0 as the first patched version.","sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116692","date":"2026-10-27","publisher":"NVD"}]}],"defenderActions":[{"title":"Upgrade every tracking server to MLflow 3.17.0 or later","detail":"Both GitHub advisories name 3.17.0 as the first fixed release. PyPI latest when this page was written is 3.17.2 (21 Oct 2026). Inventory pip and container images, including ghcr.io/mlflow/mlflow tags below 3.17.0.","priority":"now","links":[{"label":"GHSA-26p8-2jq9-3vq9","href":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9"},{"label":"GHSA-m65p-9j7q-6w33","href":"https://github.com/advisories/GHSA-m65p-9j7q-6w33"},{"label":"mlflow 3.17.0 on PyPI","href":"https://pypi.org/project/mlflow/3.17.0/"}]},{"title":"Do not expose an unauthenticated MLflow server","detail":"Tuskira compensating controls (28 Oct 2026): restrict network access. Allow the MLflow port only from the hosts and networks that need it, and take any internet-facing server off the internet first. Still upgrade to 3.17.0.","priority":"now","links":[{"label":"Tuskira compensating controls","href":"https://www.tuskira.ai/advisories/cve-2026-116692"}]},{"title":"Turn on authentication and restrict create permissions","detail":"Tuskira compensating controls (28 Oct 2026): turn on authentication. This narrows exposure from anyone to any user who can create experiments or models; it does not close either flaw. Limit who can create experiments, runs, artifacts, and registered models. Still upgrade to 3.17.0.","priority":"now","links":[{"label":"Tuskira compensating controls","href":"https://www.tuskira.ai/advisories/cve-2026-116692"}]},{"title":"Run non-root with a read-only package directory","detail":"GHSA-26p8-2jq9-3vq9: a read-only container filesystem or a scorer package directory the service user cannot write blocks the exact RCE placement chain. The official v3.14.0 image the advisory tested ran as uid 0. This does not stop CVE-2026-116690.","priority":"now","links":[{"label":"GHSA-26p8-2jq9-3vq9","href":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9"}]},{"title":"Rotate credentials and cloud keys if the server was reachable","detail":"If an affected server faced an untrusted network, treat secrets the process could read as exposed: basic-auth hashes, tracking databases, and cloud or API keys on disk or in the environment. Hunt the Detection pointers before you overwrite logs.","priority":"now","links":[{"label":"GHSA-m65p-9j7q-6w33","href":"https://github.com/advisories/GHSA-m65p-9j7q-6w33"}]}],"detection":[{"title":"Proxy and access logs for scorer invoke and registry get-artifact","detail":"Hunt reverse-proxy and MLflow access logs for /ajax-api/3.0/mlflow/scorer/invoke (GHSA-26p8-2jq9-3vq9) and for model-versions/get-artifact (GHSA-m65p-9j7q-6w33), especially from untrusted sources. A hit is reachability plus a request, not proof of code execution or file read. No Nuclei check was published in the sources we opened. Do not send crafted requests.","logSource":"Reverse-proxy / MLflow tracking-server HTTP access logs","kind":"generic","group":"web-proxy","url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27"},{"title":"Experiments whose artifact locations sit in the package tree","detail":"Review MLflow tracking metadata for experiments whose artifact location points into the server's Python package tree. Tuskira (28 Oct 2026) and GHSA-26p8-2jq9-3vq9 describe that layout as part of the RCE chain. Presence of such an experiment is a lead, not proof of import.","logSource":"MLflow tracking-server metadata (experiment artifact locations)","kind":"generic","url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28"},{"title":"Registry get-artifact on prompt sources","detail":"Review model-registry records for prompt-tagged versions whose source is a server-local path, then correlate get-artifact requests against those versions. GHSA-m65p-9j7q-6w33. A get-artifact call is not proof a sensitive file was returned.","logSource":"MLflow model-registry metadata and access logs for get-artifact","kind":"generic","group":"web-proxy","url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27"},{"title":"Unexpected children of the MLflow server process","detail":"Review host or container process telemetry for children of the MLflow server. Tuskira (28 Oct 2026) names spawned shells or unexpected child processes as a watch item after the RCE constructor runs. A child process is a lead, not proof of this CVE. No vendor process signature was published in the sources we opened.","logSource":"Host or container EDR / process-creation logs for the MLflow server","kind":"generic","group":"edr","url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28"}],"detectionRules":[{"id":"v2s-sigma-mlflow-cve-2026-116692-paths","title":"MLflow scorer invoke or registry get-artifact hunt","language":"sigma","query":"title: MLflow scorer invoke or registry get-artifact hunt\nid: 3e9b1c70-8a4d-4f2e-9c61-7d0a2b5e1844\nstatus: experimental\ndescription: Detects HTTP requests to the MLflow scorer invoke path or the model-version get-artifact path named in the GitHub advisories for CVE-2026-116692 and CVE-2026-116690. Path hunt only. Not a payload detector.\nreferences:\n    - https://github.com/advisories/GHSA-26p8-2jq9-3vq9\n    - https://github.com/advisories/GHSA-m65p-9j7q-6w33\nauthor: vuln2shell\ndate: 2026-11-02\nlogsource:\n    category: webserver\ndetection:\n    selection_scorer:\n        cs-uri-stem|contains: '/mlflow/scorer/invoke'\n    selection_artifact:\n        cs-uri-stem|contains: 'model-versions/get-artifact'\n    condition: selection_scorer or selection_artifact\nfalsepositives:\n    - Legitimate GenAI scoring or model-version artifact downloads\nlevel: high","logSource":"Reverse-proxy / MLflow tracking-server HTTP access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","sourceDate":"2026-10-27","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. A request is not proof of compromise. Tune field names to your shipper. No Nuclei check was published in the sources we opened.","tested":"untested"},{"id":"v2s-spl-mlflow-cve-2026-116692-paths","title":"MLflow scorer invoke or registry get-artifact hunt (SPL)","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=aws:waf:logs)\n(\"/mlflow/scorer/invoke\" OR \"model-versions/get-artifact\")\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, uri_path, status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Reverse-proxy / MLflow tracking-server HTTP access logs, or WAF logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","sourceDate":"2026-10-27","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. Tune sourcetype and field names to your shipper.","tested":"untested"},{"id":"v2s-kql-mlflow-cve-2026-116692-paths","title":"MLflow scorer invoke or registry get-artifact hunt (KQL)","language":"kql","query":"W3CIISLog\n| where TimeGenerated > ago(14d)\n| where csUriStem has \"/mlflow/scorer/invoke\" or csUriStem has \"model-versions/get-artifact\"\n| summarize count() , min(TimeGenerated), max(TimeGenerated) by Computer, cIP, csUriStem, scStatus\n| order by count_ desc","logSource":"Reverse-proxy / MLflow access logs shipped to Microsoft Sentinel / Defender","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","sourceDate":"2026-10-27","license":"CC0 1.0","origin":"vuln2shell","notes":"Table and field names vary by parser. Map W3CIISLog to your proxy or MLflow ingestion.","tested":"untested"},{"id":"v2s-esql-mlflow-cve-2026-116692-paths","title":"MLflow scorer invoke or registry get-artifact hunt (ES|QL)","language":"esql","query":"FROM logs-*\n| WHERE url.path LIKE \"*mlflow/scorer/invoke*\" OR url.path LIKE \"*model-versions/get-artifact*\"\n| STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, source.ip, url.path, http.response.status_code","logSource":"Reverse-proxy / MLflow access logs shipped to Elastic","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","sourceDate":"2026-10-27","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. Index and field names vary by ingest pipeline.","tested":"untested"}],"detectionLinks":[{"title":"GHSA-26p8-2jq9-3vq9 (CVE-2026-116692)","url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","author":"GitHub Advisory Database / mskca","date":"2026-10-27","note":"Vendor advisory. Names /ajax-api/3.0/mlflow/scorer/invoke. This site does not copy the attached proof of concept."},{"title":"GHSA-m65p-9j7q-6w33 (CVE-2026-116690)","url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","author":"GitHub Advisory Database / mskca","date":"2026-10-27","note":"Vendor advisory. Names the registry get-artifact sink. This site does not copy the attached proof of concept."},{"title":"Tuskira CVE-2026-116692 hunting notes","url":"https://www.tuskira.ai/advisories/cve-2026-116692","author":"Tuskira","date":"2026-10-28","note":"Defender-facing reachability and log pointers. No Nuclei check is cited there."}],"retrohunt":{"summary":"If an MLflow tracking server below 3.17.0 was reachable from 9 Oct 2026 (13 Oct 2026 for the file read), hunt proxy and access logs for /ajax-api/3.0/mlflow/scorer/invoke and registry get-artifact, then tracking metadata for package-tree artifact locations and process telemetry for children of the MLflow server.","lookback":{"from":"2026-10-09","basis":"public-poc","rationale":"mlflow/mlflow published GHSA-26p8-2jq9-3vq9, with the reporter PoC in the body, on 9 Oct 2026 08:20:37 UTC, and GHSA-m65p-9j7q-6w33, also with a reporter PoC, on 13 Oct 2026 05:56:11 UTC. Hunt from 9 Oct 2026. Previdian first observed CVE-2026-116690 attempts on 27 Oct 2026; that is the first-attempt fact, not the lookback start.","sources":[{"url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-09","publisher":"MLflow"},{"url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-13","publisher":"MLflow"},{"url":"https://securityonline.info/mlflow-vulnerability-exploited-poc/","date":"2026-10-28","publisher":"Previdian (via SecurityOnline)"}]},"logSources":[{"name":"Reverse-proxy / MLflow tracking-server HTTP access logs","why":"GHSA-26p8-2jq9-3vq9 names /ajax-api/3.0/mlflow/scorer/invoke. GHSA-m65p-9j7q-6w33 names the registry get-artifact sink.","required":true},{"name":"MLflow tracking-server metadata (experiment artifact locations)","why":"The RCE chain uses an experiment whose artifact location sits in the Python package tree.","required":true},{"name":"MLflow model-registry metadata for prompt sources","why":"CVE-2026-116690 stores a server-local path as a prompt model version source.","required":true},{"name":"Host or container process telemetry for children of the MLflow server","why":"Tuskira names unexpected child processes after the RCE constructor runs.","required":false}],"steps":[{"title":"List scorer invoke and get-artifact requests since 9 Oct 2026 (13 Oct 2026 for the file read)","detail":"Search proxy or MLflow access logs for /ajax-api/3.0/mlflow/scorer/invoke from 9 Oct 2026 and model-versions/get-artifact from 13 Oct 2026. A request is not proof of compromise. Do not send crafted requests.","sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"}]},{"title":"Review experiment artifact locations in the package tree","detail":"Inspect tracking metadata for experiments whose artifact location points into the server's Python package tree. Presence is a lead, not proof of import.","sources":[{"url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28","publisher":"Tuskira"}]},{"title":"Review prompt sources and unexpected MLflow child processes","detail":"Inspect registry records for prompt-tagged versions with a server-local source, and process telemetry for children of the MLflow server. Researcher and third-party hunting pointers, not in-the-wild persistence.","sources":[{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28","publisher":"Tuskira"}]}],"queries":[{"id":"v2s-spl-mlflow-cve-2026-116692-retrohunt","title":"MLflow scorer invoke or get-artifact since 9 Oct 2026 (13 Oct 2026 for the file read)","language":"spl","query":"index=* (\"/mlflow/scorer/invoke\" OR \"model-versions/get-artifact\") earliest=10/09/2026:00:00:00\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, uri_path, status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Reverse-proxy / MLflow tracking-server HTTP access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","sourceDate":"2026-10-27","license":"CC0 1.0","origin":"vuln2shell","notes":"Lookback window from the 9 Oct 2026 repository advisory (13 Oct 2026 for the file-read advisory). Tune sourcetype to your shipper.","tested":"untested","timeRange":"From 9 Oct 2026 (GHSA-26p8-2jq9-3vq9 public PoC; 13 Oct 2026 for GHSA-m65p-9j7q-6w33) through the last patch window"}],"artefacts":[{"kind":"web-log","value":"/ajax-api/3.0/mlflow/scorer/invoke","detail":"GHSA-26p8-2jq9-3vq9 access path. A request is reachability plus a call, not proof of code execution.","sourceUrl":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","sourceDate":"2026-10-27"},{"kind":"web-log","value":"model-versions/get-artifact","detail":"GHSA-m65p-9j7q-6w33 artifact-read sink. A request is not proof a sensitive file was returned.","sourceUrl":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","sourceDate":"2026-10-27"},{"kind":"process","value":"Unexpected child of the MLflow server process","detail":"Tuskira: spawned shells or unexpected child processes after the RCE constructor. Researcher hunting pointer, not an in-the-wild observation.","sourceUrl":"https://www.tuskira.ai/advisories/cve-2026-116692","sourceDate":"2026-10-28"}],"iocNote":"No published attacker IPs, hashes, or user-agents from a source we can copy here as of 2 Nov 2026. Previdian lists sensor IPs behind a paid view; those values are not copied. Do not invent IPs or hashes.","hitMeaning":[{"level":"attempt","detail":"scorer/invoke or get-artifact from an untrusted network, with no package-tree experiment, no unexpected MLflow child process, and no evidence a local file was returned."},{"level":"likely-compromise","detail":"Those requests plus an experiment whose artifact location sits in the package tree, or an unexpected child of the MLflow server, or a prompt version whose source is a server-local path followed by get-artifact, on a server below 3.17.0 that was reachable from 9 Oct 2026 (13 Oct 2026 for the file read)."},{"level":"compromise","detail":"Evidence that attacker-controlled code ran as the MLflow process, or that a sensitive local file was returned. No sourced in-the-wild procedure was published in the sources we opened. Independent validation: not verified.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Upgrade to 3.17.0 or later and take unauthenticated servers off untrusted networks","detail":"Both advisories name 3.17.0 as the fix. Do not expose an unauthenticated server.","links":[{"label":"GHSA-26p8-2jq9-3vq9","href":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9"},{"label":"GHSA-m65p-9j7q-6w33","href":"https://github.com/advisories/GHSA-m65p-9j7q-6w33"}]},{"title":"Preserve access logs, tracking metadata, and process audit before upgrade","detail":"Keep copies of proxy logs, experiment artifact locations, registry prompt sources, and process telemetry from 9 Oct 2026 onward (13 Oct 2026 for file-read get-artifact) before restore or upgrade.","links":[{"label":"Tuskira advisory","href":"https://www.tuskira.ai/advisories/cve-2026-116692"}]}],"limits":["Previdian attempts are a honeypot report for CVE-2026-116690 only.","No published attacker IPs are copied here.","A request to scorer/invoke or get-artifact is not proof of compromise.","First calendar day of successful compromise: not verified.","No Nuclei check was published in the sources we opened."],"sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28","publisher":"Tuskira"},{"url":"https://securityonline.info/mlflow-vulnerability-exploited-poc/","date":"2026-10-28","publisher":"SecurityOnline"}],"updatedAt":"2026-11-02"},"amIAffected":{"summary":"GitHub names MLflow 3.12.0rc0 through before 3.17.0 for CVE-2026-116692 and 3.10.0 through before 3.17.0 for CVE-2026-116690. The first fixed release is 3.17.0. Latest on PyPI when this page was written is 3.17.2 (21 Oct 2026). Preconditions: the server is reachable; authentication is off by default; with auth on, experiment/run/artifact or registered-model create rights; a writable scorer package path for the RCE; reachable registry endpoints for the file read.","checks":[{"id":"v2s-aia-mlflow-cve-2026-116692-version-1","kind":"version","title":"Record the installed MLflow version","detail":"On each host or image, run the product's own version command and compare it to the advisory ranges. Do not send crafted requests to a tracking server.","command":"mlflow --version","affectedMeans":"The Version line is 3.12.0rc0 through before 3.17.0 (CVE-2026-116692) or 3.10.0 through before 3.17.0 (CVE-2026-116690).","fixedMeans":"The Version line is 3.17.0 or later.","notes":"Inventory only. Container tags such as ghcr.io/mlflow/mlflow:v3.16.1 are in scope if that image is what you run.","sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"}]},{"id":"v2s-aia-mlflow-cve-2026-116692-package-2","kind":"package","title":"Record the pip mlflow package","detail":"The GitHub advisories list the pip package mlflow. Compare the installed version to 3.17.0.","command":"pip show mlflow","affectedMeans":"Name is mlflow and Version is 3.12.0rc0 through before 3.17.0 (RCE) or 3.10.0 through before 3.17.0 (file read).","fixedMeans":"Version is 3.17.0 or later, or the package is not installed on that host.","notes":"Use the same interpreter the tracking server runs. A system pip show can miss a virtualenv.","sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"}]},{"id":"v2s-aia-mlflow-cve-2026-116692-config-3","kind":"config","title":"Record whether authentication is on, and who can create experiments or models","detail":"GHSA: mlflow server runs without authentication by default. With basic auth on, the RCE still needs experiment/run/artifact create, and the file read still needs registered-model create. Record the start command and those role grants. Do not probe the API.","command":"On each tracking server, record whether the start command includes --app-name basic-auth (or a custom auth app), and which identities can create experiments, runs, artifacts, and registered models.","affectedMeans":"The server is below 3.17.0 and either authentication is off, or a caller has the create rights named above.","fixedMeans":"The server is 3.17.0 or later, or it is unreachable and those create rights are not granted to untrusted identities (workaround only).","notes":"Auth is a precondition, not a fix. GHSA-26p8-2jq9-3vq9: the scorer invoke path is not gated by a resource-specific permission check before import.","sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"}]},{"id":"v2s-aia-mlflow-cve-2026-116692-config-4","kind":"config","title":"Record whether the scorer package directory is writable and whether registry endpoints are reachable","detail":"The RCE chain needs a writable allowed scorer package path. The file-read chain needs reachable model-registry endpoints. Record filesystem permissions as the service user, and whether untrusted networks can reach the registry HTTP routes. Do not send crafted requests.","command":"As the MLflow service user, record whether the installed mlflow package directory is writable, and whether untrusted networks can complete a TCP connection to the tracking listen port.","affectedMeans":"The server is below 3.17.0 and either the service user can write the package tree (RCE precondition) or registry endpoints are reachable (file-read precondition).","fixedMeans":"The server is 3.17.0 or later, or the package directory is not writable by the service user and registry endpoints are not reachable from untrusted networks (workaround only).","notes":"GHSA-26p8-2jq9-3vq9: a read-only filesystem or a package directory owned by a different user blocks the exact RCE chain. That does not stop CVE-2026-116690.","sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"}]}],"limits":["No sourced Shodan or Censys fingerprint for these CVEs. Do not invent one.","No public internet-host count was published for these two flaws.","Local version commands do not prove a remote container is patched.","Authentication on is not a fix while create rights remain."],"sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://pypi.org/project/mlflow/3.17.2/","date":"2026-10-21","publisher":"PyPI"}],"updatedAt":"2026-11-02","addedDate":"2026-11-02"},"mitigations":{"summary":"Tuskira (28 Oct 2026) documents compensating controls until 3.17.0: restrict network access so the server is not exposed to untrusted networks, and turn on authentication with least create privilege. GHSA-26p8-2jq9-3vq9 documents a read-only or non-writable scorer package directory as a block on the exact RCE chain. None of those replace the 3.17.0 upgrade.","items":[{"title":"Do not expose an unauthenticated MLflow server","detail":"Tuskira compensating controls (28 Oct 2026): restrict network access. Allow the MLflow port only from the hosts and networks that need it, and take any internet-facing server off the internet first.","limits":"Not a software fix. Internal servers remain in scope if an attacker can reach the port. Still upgrade to 3.17.0.","verify":"Untrusted networks can no longer complete a TCP connection to the tracking listen port. Confirm in the edge firewall or host ACL, then re-check after the next change window. Do not send application requests to test the server.","source":{"url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28","publisher":"Tuskira"}},{"title":"Enable authentication and restrict experiment, run, artifact, and model create rights","detail":"Tuskira compensating controls (28 Oct 2026): turn on authentication and limit who can create experiments, runs, artifacts, and registered models. This narrows exposure from anyone to any user who can create experiments or models; it does not close either flaw.","limits":"Not a software fix. GHSA-26p8-2jq9-3vq9: with auth on, a caller who can still create an experiment and run and upload artifacts can use the RCE. GHSA-m65p-9j7q-6w33: a user who can create a registered model can use the file read. Still upgrade to 3.17.0.","verify":"The start command includes an auth app, unauthenticated API calls receive 401, and untrusted identities cannot create experiments or registered models. Confirm in the auth configuration, then re-check after the next change window. Do not send crafted requests.","source":{"url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28","publisher":"Tuskira"}},{"title":"Run non-root with a read-only package directory","detail":"GHSA-26p8-2jq9-3vq9: a read-only container filesystem or a scorer package directory owned by a different, non-writable user blocks the exact RCE placement chain.","limits":"Not a software fix for CVE-2026-116690. Does not replace 3.17.0. The official v3.14.0 image the advisory tested ran as uid 0, so recreate containers after you change the user and filesystem flags.","verify":"The service user is not root, and that user cannot write the installed mlflow package directory. Confirm as the service user, then re-check after the next deploy.","source":{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"}}],"updatedAt":"2026-11-02","addedDate":"2026-11-02"},"response":{"summary":"Take unauthenticated servers off untrusted networks, enable auth with least create privilege, and upgrade to 3.17.0 or later. If a server below 3.17.0 was reachable, preserve access logs, tracking metadata, and process telemetry, then rotate credentials and cloud keys the process could read. No sourced in-the-wild persistence list exists.","containment":[{"title":"Remove unauthenticated tracking servers from untrusted networks","detail":"Tuskira compensating controls (28 Oct 2026): restrict network access. Allow the MLflow port only from the hosts and networks that need it, and take any internet-facing server off the internet first.","sources":[{"url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28","publisher":"Tuskira"}]},{"title":"Enable authentication and revoke untrusted create rights","detail":"Tuskira compensating controls (28 Oct 2026): turn on authentication and remove experiment, run, artifact, and registered-model create rights from untrusted identities. This does not close either flaw for a caller who still has those create rights.","sources":[{"url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28","publisher":"Tuskira"}]},{"title":"Upgrade to MLflow 3.17.0 or later","detail":"Both advisories name 3.17.0 as the fix. An upgrade does not replace log and metadata review if the host was reachable while vulnerable.","sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://pypi.org/project/mlflow/3.17.0/","date":"2026-10-07","publisher":"PyPI"}]}],"rotate":[{"item":"Basic-auth passwords and the admin password hash","reason":"GHSA-m65p-9j7q-6w33: a low-privilege account can read the authentication database, including the admin password hash, on an affected server.","sources":[{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"}]},{"item":"Cloud keys, API tokens, and other secrets on disk or in the server environment","reason":"GHSA-26p8-2jq9-3vq9: successful RCE has confidentiality impact over credentials available to the MLflow process. GHSA-m65p-9j7q-6w33: the file read can return environment files and credential stores the process can read.","sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"}]}],"observedBehaviour":[{"title":"Honeypot attempts against CVE-2026-116690","detail":"Previdian (via SecurityOnline, 28 Oct 2026) recorded exploitation attempts against CVE-2026-116690, first observed 27 Oct 2026. Attempts only. No sourced persistence or post-exploitation procedure.","sourceUrl":"https://securityonline.info/mlflow-vulnerability-exploited-poc/","sourceDate":"2026-10-28"}],"evidence":[{"title":"Installed MLflow version from before the upgrade","detail":"Preserve mlflow --version or pip show mlflow output, and container image tags, so you can show whether the host was below 3.17.0 while reachable.","sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"}]},{"title":"Access logs for scorer invoke and get-artifact from 9 Oct 2026 (13 Oct 2026 for the file read)","detail":"Keep reverse-proxy and MLflow access logs that name /ajax-api/3.0/mlflow/scorer/invoke from 9 Oct 2026 or model-versions/get-artifact from 13 Oct 2026.","sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"}]},{"title":"Tracking metadata and process telemetry","detail":"Keep experiment artifact locations, prompt model-version sources, and host or container process audit for children of the MLflow server from 9 Oct 2026 onward (13 Oct 2026 for file-read get-artifact), before restore or upgrade.","sources":[{"url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28","publisher":"Tuskira"}]}],"limits":["No sourced in-the-wild persistence list exists.","Previdian attempts are a honeypot report for CVE-2026-116690 only.","A request to scorer/invoke or get-artifact is not proof of compromise.","Neither MLflow nor CISA has confirmed exploitation. Not in CISA KEV (checked 2 Nov 2026)."],"sources":[{"url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","publisher":"GitHub Advisory Database"},{"url":"https://securityonline.info/mlflow-vulnerability-exploited-poc/","date":"2026-10-28","publisher":"SecurityOnline"}],"updatedAt":"2026-11-02","addedDate":"2026-11-02"},"bulletins":[{"vendor":"MLflow / GitHub","title":"GHSA-26p8-2jq9-3vq9 (CVE-2026-116692)","url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","cve":"CVE-2026-116692"},{"vendor":"MLflow / GitHub","title":"GHSA-m65p-9j7q-6w33 (CVE-2026-116690)","url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","cve":"CVE-2026-116690"}],"coverage":[{"title":"GHSA-26p8-2jq9-3vq9","publisher":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","date":"2026-10-27","type":"vendor","addedDate":"2026-11-02"},{"title":"GHSA-m65p-9j7q-6w33","publisher":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","date":"2026-10-27","type":"vendor","addedDate":"2026-11-02"},{"title":"NVD CVE-2026-116692","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116692","date":"2026-10-27","type":"government","addedDate":"2026-11-02"},{"title":"NVD CVE-2026-116690","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116690","date":"2026-10-27","type":"government","addedDate":"2026-11-02"},{"title":"MLflow Vulnerability CVE-2026-116690 Exploited in the Wild as PoC Details Go Public (headline; Previdian honeypot attempts on CVE-2026-116690 only)","publisher":"SecurityOnline","url":"https://securityonline.info/mlflow-vulnerability-exploited-poc/","date":"2026-10-28","type":"news","addedDate":"2026-11-02"},{"title":"CVE-2026-116692 MLflow: is it reachable in your environment?","publisher":"Tuskira","url":"https://www.tuskira.ai/advisories/cve-2026-116692","date":"2026-10-28","type":"research","addedDate":"2026-11-02"},{"title":"Two MLflow flaws whose titles name the deployment state","publisher":"Root Notes","url":"https://rootnotes.in/article/mlflow-two-flaws-whose-titles-name-the-deployment-state","date":"2026-10-29","type":"research","addedDate":"2026-11-02"},{"title":"CVE-2026-116690 Exploitation Attempts Observed","publisher":"Previdian","url":"https://previdian.com/CVE-2026-116690","date":"2026-10-27","type":"research","addedDate":"2026-11-02"},{"title":"Daily Cybersecurity Briefing, 1 Nov 2026","publisher":"PBCS","url":"https://www.pbcsnyc.com/post/daily-cybersecurity-briefing-november-1-2026","date":"2026-11-01","type":"news","addedDate":"2026-11-02"}],"posts":[],"research":[{"title":"GHSA-26p8-2jq9-3vq9 (CVE-2026-116692)","url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","authors":"mskca (reporter); GitHub Advisory Database","date":"mlflow/mlflow 9 Oct 2026 08:20 UTC; GitHub Advisory Database 27 Oct 2026 21:26 UTC"},{"title":"GHSA-m65p-9j7q-6w33 (CVE-2026-116690)","url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","authors":"mskca (reporter); GitHub Advisory Database","date":"mlflow/mlflow 13 Oct 2026 05:56 UTC; GitHub Advisory Database 27 Oct 2026 21:26 UTC"}],"impact":{"kind":"single-product","product":"MLflow tracking server (PyPI mlflow)","versions":[{"version":"MLflow 3.12.0rc0 through before 3.17.0 (CVE-2026-116692); default no-auth, or experiment/run/artifact create plus a writable scorer package path","status":"affected","versions":"3.17.0","vendorStatement":{"date":"2026-10-27","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116692","quote":"Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts."},"addedDate":"2026-11-02"},{"version":"MLflow 3.10.0 through before 3.17.0 (CVE-2026-116690); reachable registry endpoints; default no-auth, or any user who can create a registered model","status":"affected","versions":"3.17.0","vendorStatement":{"date":"2026-10-27","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116690","quote":"Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models."},"addedDate":"2026-11-02"}]},"pocs":[{"title":"Reporter PoC in GHSA-26p8-2jq9-3vq9 (CVE-2026-116692)","url":"https://github.com/advisories/GHSA-26p8-2jq9-3vq9","source":"mskca (GitHub Advisory Database)","validationStatus":"unverified","validationDate":null,"listedDate":"2026-11-02","notes":"Reporter (mskca) attached a proof of concept to the repository advisory published to mlflow/mlflow on 9 Oct 2026 08:20:37 UTC. The GitHub Advisory Database record was published 27 Oct 2026 21:26 UTC. Tuskira (28 Oct 2026) says the CVE-2026-116692 proof is deliberately harmless. Independent validation: not verified. Index link only. This site does not copy exploit code or usage steps.","addedDate":"2026-11-02"},{"title":"Reporter PoC in GHSA-m65p-9j7q-6w33 (CVE-2026-116690)","url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","source":"mskca (GitHub Advisory Database)","validationStatus":"unverified","validationDate":null,"listedDate":"2026-11-02","notes":"Reporter (mskca) attached a proof of concept to the repository advisory published to mlflow/mlflow on 13 Oct 2026 05:56:11 UTC. The GitHub Advisory Database record was published 27 Oct 2026 21:26 UTC. Independent validation: not verified. Index link only. This site does not copy exploit code or usage steps.","addedDate":"2026-11-02"}],"pocEmptyState":"Reporter (mskca) proofs are indexed by linking the two GitHub advisories only. Status unverified. Independent validation: not verified.","_feed":{"page":"https://vuln2shell.com/vulns/mlflow-cve-2026-116692","json":"https://vuln2shell.com/vulns/mlflow-cve-2026-116692.json","iocsCsv":"https://vuln2shell.com/vulns/mlflow-cve-2026-116692/iocs.csv","stix":"https://vuln2shell.com/vulns/mlflow-cve-2026-116692/stix.json","badges":{"patch":"Patched","itw":"Exploitation attempts","poc":"Public PoC (unverified RCE)"}}}