AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-118628highSSRF & network2026-10-29

CVE-2026-118628 and five more: MLflow before 3.17.0 has an unauthenticated SSRF in get-artifacts, two unsafe-deserialization code execution bugs and three missing permission checks, upgrade to 3.17.0

Trend Micro's Zero Day Initiative published six MLflow advisories on 29 October 2026 (CVEs added to NVD on 4 November). The worst lets an unauthenticated attacker abuse the get-artifacts function, which does not validate a URI before accessing it, to disclose information from the server. Two more turn a malicious SHAP explainer or pickle evaluation artifact into code execution when someone loads it, and three let logged-in users reach Tracking Server functions they should not have access to. All are fixed by MLflow 3.17.0.

01.

What it is

CVE-2026-118628 (ZDI-26-844, SSRF, CVSS 8.2, no authentication): the get-artifacts function does not properly validate a URI before accessing resources, so a remote attacker can make the server fetch resources and disclose sensitive information in the context of the server. Fixed in MLflow 3.17.0.

CVE-2026-118627 (ZDI-26-843, code execution, CVSS 7.8): loading SHAP explainer models deserializes untrusted data without validation, so opening a malicious file or page runs code as the current user. Fixed in MLflow 3.17.0.

CVE-2026-118623 (ZDI-26-839, code execution, CVSS 7.8): PickleEvaluationArtifact parses pickle files without validating them, so a malicious pickle runs code in the context of the current process. Fixed in MLflow 3.13.0.

CVE-2026-118625 (ZDI-26-841, CVSS 6.3) and CVE-2026-118626 (ZDI-26-842, CVSS 5.4): the Tracking Server's get_endpoints function and its BEFORE_REQUEST_HANDLERS configuration skip authorization, so an authenticated user can escalate privileges to resources normally protected from them. Fixed in MLflow 3.16.0.

CVE-2026-118624 (ZDI-26-840, CVSS 5.4): the Tracking Server jobs _find_validator function skips authorization, so an authenticated user can disclose information in the context of the service account. Fixed in MLflow 3.16.0.

02.

How to check

  1. Check your MLflow version; the fixes landed in 3.13.0 (pickle artifacts), 3.16.0 (the three permission bugs) and 3.17.0 (SSRF and SHAP), so anything before 3.17.0 needs the upgrade.
  2. Check whether your tracking server is reachable by people you don't fully trust; the SSRF needs no login and the permission bugs need only an ordinary account.
  3. Check whether you or your pipelines load SHAP explainers or pickle evaluation artifacts that came from someone else.
03.

How to fix

  1. Upgrade MLflow to 3.17.0 or later.
  2. Until you can upgrade, keep the tracking server off the public internet and behind your own authentication.
  3. Don't load models, explainers or evaluation artifacts from sources you don't trust.
pip show mlflow | grep -i version
pip install -U 'mlflow>=3.17.0'
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.