CVE-2026-116692 | Mlflow up to 3.16.x Scorer base.py Scorer.model_validate_json deserialization

October 27, 2026 Yanac

A vulnerability classified as critical was found in Mlflow up to 3.16.x. Affected by this issue is the function Scorer.model_validate_json of the file mlflow/genai/scorers/base.py of the component Scorer. The manipulation results in deserialization.

This vulnerability is known as CVE-2026-116692. It is possible to launch the attack remotely. No exploit is available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More