CVE-2026-0596 PUBLISHED

Command Injection in mlflow/mlflow

Assigner: @huntr_ai
Reserved: 05.01.2026 Published: 31.03.2026 Updated: 31.03.2026

A command injection vulnerability exists in mlflow/mlflow when serving a model with enable_mlserver=True. The model_uri is embedded directly into a shell command executed via bash -c without proper sanitization. If the model_uri contains shell metacharacters, such as $() or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users.

Metrics

CVSS Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.6

Product Status

Vendor mlflow
Product mlflow/mlflow
Versions
  • affected from unspecified to latest (incl.)

References

Problem Types

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command CWE