AI agent vulnerability · MLflow

CVE-2026-0596: Mlflow: Command Injection when serving models with enable_mlserver=True

criticalCVSS 3.0 9.6GHSA-rvhj-8chj-8v3c

A command injection vulnerability exists in Mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $() or backticks, it allows for command substitution and execution of attacker-controlled commands.

Published Mar 31, 2026 · Updated May 20, 2026

Affected packages

mlflow

Ecosystem: PyPI
Affected: < 3.9.0
Fixed in: 3.9.0
Check: pip show mlflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A command injection vulnerability exists in Mlflow when serving a model with enable_mlserver=True. The model_uri is embedded directly into a shell command executed via bash -c without proper sanitization. If the model_uri contains shell metacharacters, such as $() or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users.

Credited to ConnorCallison, rotemd-apiiro.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MLflow vulnerabilities

All MLflow entries