What happened
CVE-2026-115886 (CWE-470 unsafe reflection / CWE-918 SSRF) is a deserialization-to-SSRF flaw in MLflow's scorer and GenAI-evaluate endpoints, published 2026-10-23. The vulnerable deserialization happens before a tracking-store lookup or job submission, and the attacker can drive the LiteLLM fallback to make an outbound request to an internal host with attacker-controlled headers and body.
Why it matters
MLflow is broadly deployed as the tracking/model-registry layer in MLOps and GenAI pipelines. Because the affected endpooints accept unauthenticated serialized input and can be steered into SSRF against internal services (including cloud metadata endpoints and internal model/agent backends), this gives an external attacker a foothold into an AI deployment's internal network — a classic abuse path from an ML platform to the surrounding infrastructure.
Attack vector
An unauthenticated attacker POSTs serialized third-party scorer data to the scorer/GenAI-evaluate endpoints. Scorer.model_validate_json resolves the class via a module-path allowlist without constraining the selected class or its constructor arguments. With trulens/trulens-providers-litellm installed, the attacker can select mlflow.genai.scorers.trulens, point the model URI outside MLflow's native provider registry so execution falls to the LiteLLM fallback, and supply api_base/api_key values that cause the server to issue an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body.
Affected systems
MLflow >= 3.12.0rc0, < 3.17.0
Mitigation
Upgrade to MLflow 3.17.0 (fix commit bac30b4; advisory GHSA-2wqp-q3c6-ccj5). Workaround: do not install the optional trulens/trulens-providers-litellm packages if scorer endpoints are exposed, and do not expose /ajax-api/.../scorer/invoke unauthenticated.