MLflow patches a critical remote-code-execution vulnerability
GitHub
MLflow 3.12.0 added support for deserializing third-party scorers in OSS MLflow in a way that allows request-controlled Python module imports and synchronous class instantiation via its scorer-invocation endpoint. The issue was reproduced on the official v3.14.0 image and achieved PROOF_MATCH=1 with unauthenticated arbitrary Python code execution as the MLflow server process (uid 0). MLflow has since patched the problem to block this remote-code-execution path.
Why it matters
MLflow patched a critical remote-code-execution bug, and the newsletter urges users to upgrade to version 3.17.0. It’s framed as a security fix that needs immediate attention.