What happened
Third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES instead of requiring an exact allowed module, so a caller can place a malicious module in a writable allowed package and have it imported and instantiated through the scorer/invoke endpoint. This is a distinct, more severe follow-on CVE to the earlier MLflow scorer SSRF (CVE-2026-115886), escalating from SSRf to full code execution (CVSS 9.8, CWE-94/CWE-470).
Why it matters
For AI deployments this turns an MLflow model-registry/GenAI-evaluate endpoint into an unauthenticated RCE console in default configurations: an attacker can execute code in the server process that hosts models, evals and traces, and pivot into the surrounding ML platform, datastore and any cloud credentials the process holds.
Attack vector
A caller uses MLflow artifact endpoints to drop a Python module under a writable allowed package and submits that module/class through /ajax-api/3.0/mlflow/scorer/invoke; scorer model_validate_json imports the module and constructs the class before trace processing, yielding code execution with the server's privileges.
Affected systems
MLflow >= 3.12.0rc0, < 3.17.0
Mitigation
Upgrade to MLflow 3.17.0 (GHSA-26p8-2jq9-3vq9). Restrict the allowed scorer package to a non-writable location and enable authentication on MLflow servers.