Loading story…
High-severity vulnerabilities in MLflow and BentoML exposed AI model deployment workflows to arbitrary code execution on host systems through malicious model packages. In CVE-2025-15379, MLflow's model serving container initialization code improperly interpolated dependency data from a model artifact's python_env.yaml into a shell command inside _install_model_dependencies_to_env() when env_manager=LOCAL was used, creating a command injection path. The issue affects MLflow 3.8.0 and was fixed in 3.8.2; the flaw carries CWE-77 and a CVSS 9.8-equivalent vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
In CVE-2026-35044, BentoML's generate_containerfile() function rendered user-supplied dockerfile_template files with an unsandboxed Jinja2 environment and the jinja2.ext.do extension, allowing a malicious bento archive to execute arbitrary Python code on the host when a victim ran bentoml containerize. The vulnerability affects versions before 1.4.38 and was fixed in 1.4.38; it is classified as CWE-1336 with a CVSS 8.8 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Together, the disclosures highlight a growing risk in MLOps tooling where importing or deploying untrusted model artifacts can bypass expected isolation and compromise build or serving infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-35044 was disclosed for BentoML, where an unsandboxed Jinja2 environment in generate_containerfile() could allow arbitrary Python code execution on the host when a malicious bento archive is imported and bentoml containerize is run. The issue affects versions prior to 1.4.38 and was fixed in BentoML 1.4.38.
A command injection flaw, CVE-2025-15379, was reported in MLflow's model serving container initialization code, where unsanitized dependency data from python_env.yaml could lead to arbitrary command execution when env_manager=LOCAL is used. The vulnerability affects MLflow 3.8.0 and is fixed in version 3.8.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**MLflow** disclosed and patched multiple high-severity vulnerabilities affecting deployments of the MLflow platform, including an **authentication bypass due to default credentials** in `basic_auth.ini` tracked as **CVE-2026-2635** (ZDI-26-111). The issue allows **unauthenticated remote attackers** to bypass authentication and potentially **execute arbitrary code with administrator context**; ZDI scored it **CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)** and credited the finding to **Peter Girnus (@gothburz)** via Trend Micro’s **Zero Day Initiative (ZDI)**. A separate MLflow Tracking Server flaw, **CVE-2026-2033**, enables **directory traversal leading to remote code execution** via improper validation of user-supplied artifact file paths in the artifact handler. Exploitation requires no authentication and can result in code execution in the context of the MLflow service account. Both issues reference the same upstream remediation in MLflow (`https://github.com/mlflow/mlflow/pull/19260`) and were published through ZDI advisories (including **ZDI-26-111** for CVE-2026-2635 and **ZDI-26-105** for CVE-2026-2033), indicating coordinated fixes are available and should be prioritized for exposed MLflow instances.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in widely used AI application components, affecting **Langflow** and **vLLM**. In Langflow, `CVE-2026-33497` impacts versions before **1.7.1** and stems from improper filtering of `folder_name` and `file_name` in the `/profile_pictures/{folder_name}/{file_name}` endpoint. The path traversal flaw (`CWE-22`) allows unauthenticated attackers to read files across directories, including the application's `secret_key`, creating a direct risk of secret exposure and follow-on compromise. The issue is addressed in **Langflow 1.7.1** and tracked in GitHub advisory `GHSA-ph9w-r52h-28p7`. A separate flaw in vLLM, `CVE-2026-27893`, can lead to **remote code execution** by bypassing a user's attempt to disable remote code trust. In versions from **0.10.1** up to but not including **0.18.0**, two model implementation files hardcoded `trust_remote_code=True`, overriding the safer `--trust-remote-code=False` setting and allowing malicious model repositories to run code during model use. The vulnerability, classified as `CWE-693`, was patched in **vLLM 0.18.0**, underscoring supply-chain and configuration-bypass risks in AI infrastructure components.
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-64849**, a critical unauthenticated server-side request forgery flaw in MLflow’s webhook delivery logic, to steal credentials and sensitive data from exposed tracking server deployments. The vulnerability affects MLflow versions prior to **`3.15.0`** and abuses the default-enabled model-registry webhooks API, allowing crafted webhook requests to reach internal services and cloud metadata endpoints. Researchers reported exploitation within hours of the CVE being assigned, with attempts to extract secrets from addresses including **`127.0.0.1`** and **`169.254.169.254`**. The flaw stems from MLflow validating a webhook URL and then re-resolving or following redirect targets during delivery, enabling DNS rebinding or redirect-based access to non-public destinations. Successful exploitation can expose highly privileged credentials, including AWS IAM role credentials tied to EC2 instances or Kubernetes nodes, and may provide access to internal databases, configurations, and administrative tools. The vulnerability carries a **CVSS 9.3** rating, and MLflow **`3.15.0`** addresses it by tightening destination validation and blocking non-global IP addresses; defenders are being urged to patch immediately and investigate whether secrets or cloud credentials were exposed.
Aug 20, 2026