Attackers exploit MLflow file read flaw as PoC code emerges

SecurityOnline[.]info reports that attackers are actively probing MLflow servers for two newly disclosed vulnerabilities, CVE-2026-116690 and CVE-2026-116692, with PoC code published and exploitation attempts observed within 24 hours of the CVEs’ public release on 27 October 2026.

The file-read flaw (CVE-2026-116690, CVSS 7.5) allows unauthenticated users to read files from the MLflow server by supplying a relative path as a prompt source; MLflow’s artifact download can then serve files such as /etc/passwd or database contents. The article notes that even basic-auth servers are vulnerable, with a low-privilege account able to read the authentication database and admin password hashes. Evidence cited includes Previdian’s honeypot network capturing exploitation attempts targeting these flaws, and public advisories containing PoC scripts.

The other flaw, CVE-2026-116692 (CVSS 9.8, CWE-94), enables unauthenticated remote code execution via third-party scorer support introduced in MLflow 3.12.0. The server imports a Python module named in the request if the module name starts with an allowed package prefix, but the advisory warns that a prefix is not a provenance boundary. An attacker can upload a module under an allowed path and trigger its execution on a subsequent request; the PoC reportedly ran as root on the official v3.14.0 Docker image.

Affected versions are MLflow 3.10.0 through 3.16.1 for CVE-2026-116690, and MLflow 3.12.0 through 3.16.x for CVE-2026-116692. The patch is MLflow 3.17.0, released on 7 October, which restricts prompt-version sources to MLflow’s own placeholders. The article cites vendor advisories and notes that, while CVE-2026-116690 has been exploited in the wild, there is no confirmed in-the-wild exploitation of CVE-2026-116692 at the time of reporting.