CVE-2026-115886 | MLflow up to 3.16.x Scorer invoke Scorer.model_validate_json api_key deserialization

October 23, 2026 Yanac

A vulnerability was found in MLflow up to 3.16.x and classified as critical. This affects the function Scorer.model_validate_json of the file /ajax-api/3.0/mlflow/scorer/invoke of the component Scorer. Such manipulation of the argument api_key leads to deserialization.

This vulnerability is listed as CVE-2026-115886. The attack may be performed from remote. There is no available exploit.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More