PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-0596 mlflow CVE debrief

CVE-2026-0596 is a high-severity command injection vulnerability in mlflow/mlflow. The vulnerability exists when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacharacters, such as `$()` or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users. Users of mlflow/mlflow, especially those serving models with `enable_mlserver=True`, should be aware of this vulnerability and take immediate action to mitigate the risk.

Vendor
mlflow
Product
mlflow/mlflow
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-21
Advisory published
2026-03-31
Advisory updated
2026-07-21

Who should care

Users of mlflow/mlflow, especially those serving models with `enable_mlserver=True`, should be aware of this vulnerability and take immediate action to mitigate the risk. This vulnerability can lead to privilege escalation and execution of arbitrary commands. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to prioritize defensive actions.

Technical summary

The vulnerability exists in the mlflow/mlflow project when serving a model with `enable_mlserver=True`. The `model_uri` parameter is not properly sanitized, allowing attackers to inject shell metacharacters and execute arbitrary commands. The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. Affected deployments should prioritize updates or mitigations through normal change control. Compensating controls, such as restricting access to model serving directories and monitoring for suspicious activity, are recommended while remediation is scheduled and verified.

Defensive priority

High

Recommended defensive actions

  • Update to the latest patched version of mlflow/mlflow
  • Disable `enable_mlserver=True` if not required
  • Validate and sanitize `model_uri` inputs
  • Monitor for suspicious activity and implement compensating controls
  • Restrict access to model serving directories
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-03-31T15:16:10.843Z and last modified on 2026-07-21T19:10:00.107Z. The NVD entry is currently Analyzed. The vulnerability has been reported by [email protected] and has a CWE-78 classification. There are limited details on the exploitability and potential impact, but defenders should verify affected scope and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T15:16:10.843Z and has not been modified since then. The NVD entry is currently Analyzed.