CVE-2026-116692: CVE-2026-116692: Remote Code Execution in MLflow via Third-Party Scorer Deserialization

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

CVE-2026-116692: Remote Code Execution in MLflow via Third-Party Scorer Deserialization. Vulnerability ID: CVE-2026-116692. CVSS Score: 9.8. Published: 2026-10-27. CVE-2026-116692 (GHSA-26p8-2jq9-3vq9) is a remote code execution vulnerability in MLflow affecting versions 3.12.0rc0 prior to 3.17.0.

CVE-2026-116692：通过第三方评分器反序列化在 MLflow 中实现远程代码执行。漏洞 ID：CVE-2026-116692。CVSS 评分：9.8。发布日期：2026-10-27。CVE-2026-116692 (GHSA-26p8-2jq9-3vq9) 是 MLflow 中的一个远程代码执行漏洞，影响 3.12.0rc0 到 3.17.0 之前的版本。

The flaw stems from an overly permissive module prefix check during the deserialization of third-party GenAI evaluation scorers in mlflow/genai/scorers/base.py. By setting an experiment’s artifact root to a local package directory within the Python module search path and uploading a crafted Python file as a run artifact, an attacker can invoke the /ajax-api/3.0/mlflow/scorer/invoke endpoint to dynamically import and execute arbitrary code on the MLflow tracking server.

该缺陷源于在 mlflow/genai/scorers/base.py 中对第三方 GenAI 评估评分器进行反序列化时，模块前缀检查过于宽松。通过将实验的工件根目录设置为 Python 模块搜索路径内的本地包目录，并上传一个精心制作的 Python 文件作为运行工件，攻击者可以调用 /ajax-api/3.0/mlflow/scorer/invoke 端点，从而在 MLflow 跟踪服务器上动态导入并执行任意代码。

TL;DR An insecure module prefix check in MLflow’s third-party GenAI scorer deserialization allows attackers to upload malicious Python artifacts into writable package directories and execute arbitrary code via dynamic module importation on unauthenticated or authenticated MLflow servers. ⚠️ Exploit Status: POC.

简而言之：MLflow 第三方 GenAI 评分器反序列化中不安全的模块前缀检查，允许攻击者将恶意 Python 工件上传到可写的包目录中，并通过动态模块导入在未经身份验证或已身份验证的 MLflow 服务器上执行任意代码。⚠️ 利用状态：POC（概念验证）。

Technical Details: CVE / GHSA ID: CVE-2026-116692 / GHSA-26p8-2jq9-3vq9. CWE Classification: CWE-94 (Code Injection) / CWE-470 (Unsafe Reflection). CVSS v3.1 Score: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected Versions: MLflow >= 3.12.0rc0, < 3.17.0. Patched Version: MLflow 3.17.0. Vulnerable Component: Scorer.model_validate() in mlflow/genai/scorers/base.py.

技术细节：CVE / GHSA ID：CVE-2026-116692 / GHSA-26p8-2jq9-3vq9。CWE 分类：CWE-94（代码注入）/ CWE-470（不安全反射）。CVSS v3.1 评分：9.8 严重 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)。受影响版本：MLflow >= 3.12.0rc0, < 3.17.0。已修复版本：MLflow 3.17.0。易受攻击组件：mlflow/genai/scorers/base.py 中的 Scorer.model_validate()。