PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-0596 mlflow CVE debrief

CVE-2026-0596 is a high-severity command injection vulnerability in mlflow/mlflow. The vulnerability exists when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacharacters, such as `$()` or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users. Users of mlflow/mlflow, especially those serving models with `enable_mlserver=True`, should be aware of this vulnerability and take immediate action to mitigate the risk.

Vendor
mlflow
Product
mlflow/mlflow
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-21
Advisory published
2026-03-31
Advisory updated
2026-07-21

Who should care

Users of mlflow/mlflow, especially those serving models with `enable_mlserver=True`, should be aware of this vulnerability and take immediate action to mitigate the risk. This vulnerability can lead to privilege escalation and execution of arbitrary commands. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to prioritize defensive actions.

Technical summary

The vulnerability exists in the mlflow/mlflow project when serving a model with `enable_mlserver=True`. The `model_uri` parameter is not properly sanitized, allowing attackers to inject shell metacharacters and execute arbitrary commands. The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. Affected deployments should prioritize updates or mitigations through normal change control. Compensating controls, such as restricting access to model serving directories and monitoring for suspicious activity, are recommended while remediation is scheduled and verified.

Defensive priority

High

Recommended defensive actions

  • Update to the latest patched version of mlflow/mlflow
  • Disable `enable_mlserver=True` if not required
  • Validate and sanitize `model_uri` inputs
  • Monitor for suspicious activity and implement compensating controls
  • Restrict access to model serving directories
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-03-31T15:16:10.843Z and last modified on 2026-07-21T19:10:00.107Z. The NVD entry is currently Analyzed. The vulnerability has been reported by [email protected] and has a CWE-78 classification. There are limited details on the exploitability and potential impact, but defenders should verify affected scope and vendor guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-0596 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-0596

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-0596 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-0596

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.