CVE-2026-0596: MLflow Command Injection RCE Vulnerability

CVE-2026-0596 Overview

A critical command injection vulnerability exists in mlflow/mlflow when serving a model with enable_mlserver=True. The model_uri parameter is embedded directly into a shell command executed via bash -c without proper sanitization. If the model_uri contains shell metacharacters, such as $() or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users.

Critical Impact

Attackers with adjacent network access can achieve full system compromise through command injection, potentially leading to privilege escalation when higher-privileged services process malicious model URIs.

Affected Products

• mlflow/mlflow (latest version affected)
• MLflow deployments using enable_mlserver=True configuration
• Systems where higher-privileged services serve models from user-writable directories

Discovery Timeline

• 2026-03-31 - CVE-2026-0596 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-0596

Vulnerability Analysis

This command injection vulnerability (CWE-78) occurs in MLflow's model serving functionality when the enable_mlserver=True option is configured. The core issue stems from unsafe handling of the model_uri parameter, which is directly interpolated into a shell command string and executed through bash -c without any input sanitization or escaping.

When a user or automated process requests MLflow to serve a model, the system constructs a shell command that includes the provided model URI. An attacker who can control or influence the model_uri value can inject arbitrary shell commands by including shell metacharacters such as command substitution syntax $() or backticks.

The vulnerability is particularly severe in multi-tenant environments or systems where lower-privileged users can write to directories that higher-privileged services read from. In such scenarios, successful exploitation can result in privilege escalation, allowing an attacker to execute commands with elevated permissions.

Root Cause

The root cause of this vulnerability is the lack of proper input sanitization when embedding the model_uri parameter into shell commands. The MLflow codebase directly concatenates user-controlled input into a command string passed to bash -c, violating the principle of never trusting user input in security-sensitive contexts. The absence of shell escaping, quoting, or parameterized command execution creates the injection vector.

Attack Vector

The attack requires adjacent network access to the affected MLflow instance. An attacker can craft a malicious model_uri containing shell metacharacters that, when processed by the vulnerable model serving functionality, results in arbitrary command execution. The attack does not require authentication or user interaction, and can affect other resources beyond the vulnerable component due to the scope change characteristic.

A malicious model URI might contain patterns like $(malicious_command) or `malicious_command` embedded within an otherwise legitimate-looking path. When MLflow processes this URI through bash -c, the shell interprets these metacharacters and executes the injected commands with the privileges of the MLflow service process.

For technical details on the vulnerability mechanism, see the Huntr Bounty Listing.

Detection Methods for CVE-2026-0596

Indicators of Compromise

• Unusual process spawning from MLflow service processes, particularly shells or unexpected child processes
• Model URIs containing shell metacharacters such as $(), backticks, semicolons, or pipe operators in logs
• Unexpected outbound network connections from MLflow serving processes
• File system modifications or new files created by the MLflow service user

Detection Strategies

• Monitor MLflow access logs for model URIs containing suspicious patterns including $(, `, ;, |, &&, or other shell metacharacters
• Implement application-level logging to capture all model_uri parameters before processing
• Deploy runtime application self-protection (RASP) solutions to detect command injection attempts
• Use endpoint detection and response (EDR) solutions to identify anomalous process execution chains

Monitoring Recommendations

• Configure SIEM rules to alert on shell metacharacter patterns in MLflow-related log entries
• Monitor for unusual process trees originating from MLflow service accounts
• Implement file integrity monitoring on critical system directories accessible by MLflow processes
• Track network connections initiated by MLflow services for signs of data exfiltration or reverse shells

How to Mitigate CVE-2026-0596

Immediate Actions Required

• Disable the enable_mlserver=True option in MLflow configurations until a patch is available
• Restrict network access to MLflow model serving endpoints to trusted networks only
• Implement strict input validation for all model_uri parameters at the application perimeter
• Review and restrict file system permissions to prevent lower-privileged users from writing to model directories
• Run MLflow services with minimal required privileges following the principle of least privilege

Patch Information

No vendor patch information is currently available. Organizations should monitor the Huntr Bounty Listing and official MLflow channels for security updates.

Workarounds

• Disable the enable_mlserver=True configuration option and use alternative model serving methods
• Implement a reverse proxy or web application firewall (WAF) to filter requests containing shell metacharacters in model URI parameters
• Isolate MLflow services in containerized environments with restricted capabilities and read-only file systems
• Deploy network segmentation to limit adjacent network access to MLflow endpoints

# Configuration example - Disable MLServer integration
# In your MLflow serving configuration, ensure enable_mlserver is set to False

# Example: Serving a model without MLServer (safer approach)
mlflow models serve -m models:/my_model/1 --port 5000 --no-conda

# If using Docker, run with restricted capabilities
docker run --cap-drop=ALL --read-only \
  -v /path/to/models:/models:ro \
  mlflow-serving:latest