CVE-2026-79721

All versions of the MLflow platform from 0.0.1 onward are vulnerable to arbitrary code execution when the tooling loads a maliciously crafted model artifact, a flaw classified under CWE-829 (inclusion of functionality from an untrusted control sphere). An attacker with low privileges — for example, the ability to publish or modify a model artifact in a registry or shared artifact store — crafts a model containing embedded code, and the code executes when a user loads that artifact (user interaction is required per the CVSS 4.0 vector). Successful exploitation gives the attacker arbitrary code execution with the privileges of the loading process on the end user's system, with high confidentiality, integrity and availability impact (CVSS 4.0 score 8.6, High). Anyone running any released version of MLflow is potentially affected, particularly teams that load models from shared, external or less-trusted sources. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so exploitation is not currently known to be occurring.

What to do: Treat model artifacts as untrusted input: only load models you produced or obtained from trusted parties, restrict write access to MLflow model registries and artifact stores so unprivileged or external parties cannot plant crafted models, and perform model loading in sandboxed or low-privilege environments. No fixed version is stated in the available data, so monitor the MLflow project's security advisories and upgrade to a patched release as soon as one is published. Audit which users or pipelines load externally sourced models, since loading a crafted artifact is the trigger for this flaw.