CVE-2026-116692

## Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously. An HTTP caller can combine this behavior with MLflow's built-in experiment, run, and artifact-upload endpoints: 1. Create an experiment whose local artifact location points to a writable allowed scorer package. 2. Create a run, causing MLflow to allocate `<artifact_location>/<run_id>/artifacts/`. 3. Upload a Python module into that run artifact directory. 4. Submit a serialized third-party scorer whose module path resolves to the uploaded file. 5. Trigger server-side import and class construction through `/ajax-api/3.0/mlflow/scorer/invoke`. On the default no-auth server using the official MLflow v3.14.0 image, this produces unauthenticated arbitrary Python code execution with the privileges of the MLflow server process. The reproduced image runs the process as uid 0 and permits writes to its installed Python package tree. The attached proof of concept is intentionally harmless. The uploaded constructor performs one action only: it writes a random marker beside its own uploaded run artifact. The marker is then downloaded through MLflow's run-artifact endpoint and checked for an exact match. ## Technical details ### 1. The allow-list accepts attacker-created descendants At release commit `86cd7f5a1dc25a1387ad07c87811bbc30f62951c`, `mlflow/genai/scorers/scorer_utils.py` defines these allowed roots: ```python THIRD_PARTY_SCORER_ALLOWED_MODULES = frozenset({ "mlflow.genai.scorers.ragas", "mlflow.genai.scorers.deepeval", "mlflow.genai.scorers.trulens", "mlflow.genai.scorers.phoenix", }) ``` In `mlflow/genai/scorers/base.py`, the deserializer accepts either an exact root or any descendant: ```python module_p