MLflow scorer imports executed Python before a scoring request

MLflow imported a user-controlled Python scorer module from an allowed third-party module prefix before checking the request as a scoring job.

The attack presupposes an affected MLflow server with a writable module namespace, including the demonstrated official 3.14.0 Docker image. The maintainer reproduced a command-execution marker running with the server process authority before an eventual HTTP 500 response.

The proof is a controlled reproduction, not evidence of a breached customer server; CVE-2026-116692 is distinct from MLflow scorer SSRF. Upgrade to MLflow 3.17.0 and prevent uploaded artifacts from being imported as trusted Python scorers.

Evidence interpretation and control boundary. The shell was not required for execution: Python importlib executed a module located under a supposedly allowed package prefix, after the same server had accepted an artifact upload into that namespace. The reproduced default Docker container used an unauthenticated server process with elevated container privileges, but those conditions are not universal to secured MLflow deployments. An eventual HTTP error did not roll back the import-time effect.