MLflow RCE CVE-2026-116692 rated 9.8 via scorer deserialization

CVE-2026-116692 in MLflow 3.12.0rc0 through 3.17.0 allows remote code execution through deserialization of third-party GenAI scorers: a loose module prefix check lets attackers import a crafted Python artifact from a writable package directory. The flaw is fixed in MLflow 3.17.0 and a PoC is public.

• CVSS 9.8: unauthenticated RCE via the /ajax-api/3.0/mlflow/scorer/invoke endpoint
• Affects MLflow >= 3.12.0rc0, < 3.17.0, including official Docker images
• Patch 3.17.0 replaces prefix matching with exact allow-list module matching
• PoC published; not listed in CISA KEV