Live › vulnerability › CVE-2026-118627
MLflow's SHAP load_explainer function deserializes untrusted data without validating it, so a crafted model file can execute code. An attacker gets code execution as the user running MLflow once the target opens the malicious file or visits a malicious page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Teams running MLflow older than 3.17.0 that load SHAP explainer models (mlflow.shap.load_explainer or SHAP-flavor models) from files, registries or shared storage they do not control. A crafted model file runs code as the user running MLflow when it is loaded. Teams that never load SHAP explainers, or only load ones they trained themselves, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mlflow | pypi | < 3.17.0 | 3.17.0 |
pip show mlflow (also mlflow-skinny); versions below 3.17.0 are affected per ZDI. NVD lists 3.11.2.dev0 as an affected version.mlflow.shap.load_explainer or loading of SHAP-flavor models from registries or files you did not create.3.17.0 or later (per ZDI-26-843)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the loading of SHAP explainer models. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30301.
This page as .md · .json · in your agent: get_signal("CVE-2026-118627")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.