H3-2026-1138¶

MLflow Ensemble Scorer Nested Call Source Code Injection

Description¶

MLflow validates registered scorer definitions for a call source field that would let a scorer execute arbitrary code, but the validation only inspects the top level of the submitted scorer document. An ensemble scorer definition nests a list of component scorers inside its own data structure. Remote attackers can place a decorator scorer containing a call source field inside that nested list, which the top level check never inspects. When a server with custom scorer execution enabled later invokes the ensemble scorer, the nested call source is passed to a code execution path during deserialization. The scorer document persists in the MLflow tracking server's database once registered, so the injected code remains available for repeated invocation.

Impact¶

Remote attackers execute arbitrary Python code on the MLflow tracking server. The malicious scorer document persists in the server database and can be invoked repeatedly. Successful exploitation can lead to credential theft, lateral movement, or further compromise of reachable systems. Organizations running MLflow with custom scorer execution enabled on a reachable server face full server compromise.

References¶

• MLflow Ensemble Scorer Nested Call Source Advisory
• MLflow Recursive Custom Scorer Execution Block Fix