The report
A scoring request, an artifact location and an automatic trace are three different ways data can cross an MLflow trust boundary. Recently disclosed advisories show why the same service can suffer code execution, server-file disclosure and credential leakage without any of those being interchangeable descriptions of one bug.
The three paths
| Path | Mechanism | What the demonstration supports |
|---|---|---|
| Scorer import | A caller-placed Python module was imported under an accepted third-party scorer prefix before scoring validation | A code-execution marker ran under the server process in a default unauthenticated Docker example |
| Prompt model source | A relative, scheme-less artifact path passed a filtering condition and resolved on the server | Local file reads were reachable through affected model-version metadata |
| CrewAI autolog | Instrumentation serialized the LLM object and its inputs into trace attributes | Provider API-key material appeared in controlled telemetry spans |
The import advisory matters because a subsequent HTTP error did not reverse execution already performed at module import time. The path advisory instead concerns which file the backend is permitted to retrieve. The CrewAI tracing advisory concerns secrets sent into an observability system that may have a separate retention and access policy.
One version number, three different checks
All three reports identify MLflow 3.17.0 as a fixed release. That does not mean every MLflow installation was exposed to every issue. Scorer import required the relevant writable module and endpoint path; file retrieval depended on crafted version-source metadata; autologging had to be enabled with affected CrewAI integration.
Operators should verify the feature actually used, the server build and the authority of the importer or telemetry collector. A patched serializer cannot delete provider keys already copied into historical traces; those require a retention and credential-rotation decision based on actual trace access. No confirmed broad victim campaign is established by these advisories.