CVE-2026-116692: Critical RCE in MLflow via custom scorers

MLflow, the open source engineering platform for AI agents and machine learning models, is affected by vulnerability CVE-2026-116692. The issue concerns third-party scorer deserialization in mlflow/genai/scorers/base.py, which accepts any descendant of the allowed modules instead of requiring an exact match, enabling code execution via the /ajax-api/3.0/mlflow/scorer/invoke endpoint.

According to available data the vulnerability carries a CVSS score of 9.8, critical tier. It was published on NVD on October 27, 2026 and fixed in version 3.17.0. With authentication disabled, code execution requires no credentials; with basic auth, a principal able to create experiments and upload artifacts is required. In either case the allowed scorer package must be writable by the server. No reports of public exploit repositories appear in the data. Minimal social activity is recorded (4 posts, 7 interactions), a discussion signal not technically verified.

Teams running MLflow should update immediately to version 3.17.0 or later. It is important to verify that allowed scorer packages are not writable by the server process, review active authentication configurations, and restrict experiment creation and artifact upload permissions to trusted principals, also auditing publicly exposed artifact endpoints.