CVE-2026-79721: MLflow Platform RCE Vulnerability

CVE-2026-79721 Overview

CVE-2026-79721 is a code execution vulnerability in the MLflow machine learning platform. A maliciously crafted model artifact executes arbitrary code on the end user's system when the project loads it. The flaw affects MLflow version 0.0.1 and newer, making the exposure broad across production and development installations. The weakness maps to [CWE-829: Inclusion of Functionality from Untrusted Control Sphere], reflecting the risk of loading external model files without sufficient validation.

Critical Impact
Loading an attacker-supplied MLflow model artifact triggers arbitrary code execution in the context of the user running the MLflow project.

Affected Products

MLflow platform, version 0.0.1 and newer
MLflow project loaders that consume external model artifacts
Downstream ML pipelines and notebooks that deserialize untrusted MLflow models

Discovery Timeline

2026-09-08 - CVE-2026-79721 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79721

Vulnerability Analysis

MLflow packages machine learning models as artifacts that bundle serialized objects, dependency metadata, and loader logic. When a user loads a model through MLflow's project workflow, the platform reconstructs the object graph and invokes the associated framework code. An attacker who controls the model artifact can embed executable payloads inside the serialized content or loader hooks.

Exploitation requires the victim to load the malicious artifact, aligning with the User Interaction: Passive requirement in the vector. Once the artifact is loaded, code runs with the privileges of the MLflow process. This exposes credentials, training data, and adjacent cloud resources to compromise.

The HiddenLayer advisory attributes the issue to unsafe handling of externally supplied model content during load operations. Confidentiality, integrity, and availability of the host system are all at risk.

Root Cause

The root cause is inclusion of functionality from an untrusted control sphere [CWE-829]. MLflow reconstructs model objects and invokes framework loaders without enforcing trust boundaries on artifact provenance. Serialization formats commonly used in ML frameworks execute code during deserialization, so any attacker-controlled artifact becomes an execution primitive.

Attack Vector

The attack vector is network-based delivery of the malicious model artifact, followed by local execution when a user loads the model. Delivery paths include public model registries, shared artifact stores, supply-chain pull requests, and links to attacker-hosted artifact URIs. The attacker needs low privileges on the MLflow instance and one user action to trigger execution.

The MLflow project has published guidance on this class of issue. Refer to the HiddenLayer Security Advisory for technical detail on the loader path involved. No verified public proof-of-concept code is available at publication time.

Detection Methods for CVE-2026-79721

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running mlflow modules or MLflow project entry points
Outbound network connections from ML training or serving hosts to unfamiliar domains shortly after mlflow.pyfunc.load_model or similar loader calls
New or modified model artifacts in the MLflow tracking store originating from unauthenticated or external users
Shell, curl, wget, or interpreter invocations traced back to model deserialization callbacks

Detection Strategies

Monitor process lineage for MLflow worker processes launching shells, package managers, or reverse-shell utilities
Inspect model artifacts for embedded __reduce__ hooks, custom PythonModel loader code, or unexpected pickle opcodes prior to loading
Alert on MLflow registry writes from principals outside approved data science accounts or CI/CD service identities
Correlate artifact download events with subsequent anomalous file writes under home directories, /tmp, or cloud credential paths

Monitoring Recommendations

Forward MLflow tracking server logs, registry audit events, and host process telemetry to a centralized data lake for correlation
Baseline normal loader behavior per model and alert on deviations such as new outbound sockets or credential file reads
Track access to cloud metadata endpoints (169.254.169.254) from ML training hosts, which is a common post-exploitation step

How to Mitigate CVE-2026-79721

Immediate Actions Required

Restrict MLflow model registry write access to trusted, authenticated principals only
Quarantine and re-review any model artifacts contributed by external or unverified users before loading
Isolate MLflow workers and notebooks in network segments without direct access to production secrets or cloud metadata services
Rotate credentials accessible to any MLflow host that may have loaded untrusted artifacts

Patch Information

Consult the HiddenLayer Security Advisory for fixed version details and upgrade guidance from the MLflow maintainers. Upgrade all MLflow clients, tracking servers, and worker nodes to the vendor-supplied fixed release. Rebuild container images that embed MLflow so cached vulnerable versions are removed.

Workarounds

Load models only from artifact stores you fully control and whose write path is authenticated
Execute model loading in ephemeral sandboxes with no network egress and no access to long-lived credentials
Enforce code review on any custom PythonModel, pyfunc, or loader module added to the model registry
Disable automatic model loading from untrusted URIs in shared notebooks and scheduled jobs

bash

# Configuration example: restrict MLflow tracking to an authenticated internal endpoint
# and run loaders inside a network-isolated container.
export MLFLOW_TRACKING_URI="https://mlflow.internal.example.com"
export MLFLOW_TRACKING_TOKEN="$(vault read -field=token secret/mlflow)"

docker run --rm \
  --network=none \
  --read-only \
  --tmpfs /tmp \
  --user 10001:10001 \
  -e MLFLOW_TRACKING_URI \
  -e MLFLOW_TRACKING_TOKEN \
  mlflow-loader:pinned \
  python -c "import mlflow; mlflow.pyfunc.load_model('models:/approved-model/Production')"