{"id":"CVE-2026-118627","kind":"vulnerability","aliases":["CVE-2026-118627"],"related":[],"title":"MLflow: SHAP explainer loading lets a crafted file run code","description":"MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the loading of SHAP explainer models. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30301.","summary":"MLflow's SHAP load_explainer function deserializes untrusted data without validating it, so a crafted model file can execute code. An attacker gets code execution as the user running MLflow once the target opens the malicious file or visits a malicious page.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mlflow","fixed":["3.17.0"],"affected":"< 3.17.0","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","deserialization","machine-learning","mlflow","python"],"not_affected_if":["no-shap-explainer-loading","trusted-model-files-only"],"how_to_check":"- Run `pip show mlflow` (also mlflow-skinny); versions below 3.17.0 are affected per ZDI. NVD lists 3.11.2.dev0 as an affected version.\n- Search your code and pipelines for `mlflow.shap.load_explainer` or loading of SHAP-flavor models from registries or files you did not create.\n- Check whether MLFLOW_ALLOW_PICKLE_DESERIALIZATION is set in those environments; after the fix, setting it to true re-enables unpickling.","fix":"Upgrade to MLflow 3.17.0 or later (per ZDI-26-843). The code fix (PR 25566) makes mlflow.shap.load_explainer refuse to unpickle unless MLFLOW_ALLOW_PICKLE_DESERIALIZATION is enabled. Until upgraded, load SHAP explainers only from files you created.","status":"open","published_at":"2026-11-04T00:17:23+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:47:50+00:00","updated_at":"2026-11-04T00:48:28+00:00","category":"ai-tooling","confidence":0.75,"triage":{"at":"2026-11-04T00:47:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MLflow: SHAP explainer loading lets a crafted file run code","impact":"high","summary":"MLflow's SHAP load_explainer function deserializes untrusted data without validating it, so a crafted model file can execute code. An attacker gets code execution as the user running MLflow once the target opens the malicious file or visits a malicious page.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mlflow","python","machine-learning"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code runs as the current user on the machine","analyst_note":"Confirm affected MLflow version ranges and whether a fix is released; check the NVD entry and the ZDI advisory for ZDI-CAN-30301.","how_to_check":"- Check the installed MLflow version with `pip show mlflow`\n- Look for code that calls `mlflow.shap.load_explainer` on files from outside the team\n- unknown whether a specific setting changes exposure","plain_action":"","needs_analyst":true,"not_affected_if":["no-shap-explainer-loading","trusted-model-files-only"],"who_is_affected":"Teams that load SHAP explainer models with MLflow, especially from files they did not create themselves. Systems that only log and serve models they trained in-house with no external inputs are less exposed. The sources do not list affected version ranges.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4236,"output_tokens":531,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected MLflow version ranges and whether a fix is released; check the NVD entry and the ZDI advisory for ZDI-CAN-30301.","search":"'-118627':13A,16A '-2026':12A,15A '30301':170C 'affect':91C 'ai':19B 'ai-tool':18B 'allow':83C 'arbitrari':88C 'attack':48B,85C,151C 'code':10A,46B,50B,78C,89C,158C 'context':161C 'craft':7A,41B 'current':164C 'cve':11A,14A 'data':35B,76C,141C,149C 'deseri':21B,33B,73C,146C 'execut':45B,51B,79C,87C,157C 'exist':120C 'explain':3A,31B,72C,126C 'exploit':100C 'file':8A,43B,63B,116C 'flaw':119C 'function':32B 'get':49B 'instal':92C 'interact':96C 'issu':129C 'lack':133C 'learn':24B 'let':5A 'leverag':153C 'load':4A,30B,71C,123C 'machin':23B 'machine-learn':22B 'malici':62B,67B,110C,115C 'mlflow':1A,17A,25B,27B,56B,69C,94C 'model':42B,127C 'must':107C 'open':60B,113C 'page':68B,111C 'proper':135C 'python':26B 'remot':77C,84C 'requir':98C 'result':130C,144C 'run':9A,55B 'shap':2A,29B,70C,125C 'specif':118C 'suppli':140C 'target':59B,106C 'tool':20B 'untrust':34B,75C,148C 'user':54B,95C,139C,165C 'user-suppli':138C 'valid':37B,136C 'visit':65B,108C 'vulner':80C,82C,102C,155C 'within':121C 'without':36B 'zdi':168C 'zdi-can':167C","nicknames":[],"mitigations":[],"who_affected":"Teams running MLflow older than 3.17.0 that load SHAP explainer models (mlflow.shap.load_explainer or SHAP-flavor models) from files, registries or shared storage they do not control. A crafted model file runs code as the user running MLflow when it is loaded. Teams that never load SHAP explainers, or only load ones they trained themselves, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mlflow"],"ptokens":["mlflow"],"labels":["aitooling","deserialization","high","machinelearning","mlflow","python"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118627","severity":null,"published_at":"2026-11-04T00:17:23+00:00","modified_at":"2026-11-04T00:17:24+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118627:1587","url":null,"severity":null,"published_at":"2026-11-04T00:48:28+00:00","modified_at":"2026-11-04T00:48:28+00:00","first_seen_at":"2026-11-04T00:48:28+00:00","fetched_at":"2026-11-04T00:48:28+00:00","note":"ZDI-26-843 says fixed in 3.17.0 and links PR 25566 (merged 2026-09-03, adds pickle guard to mlflow.shap). Fix version comes from ZDI, not an MLflow release page, so nothing marked verified. NVD lists affected 3.11.2.dev0 only; lower bound unknown. No exploitation or PoC seen. Sibling MLflow CVEs (118623, 118628) are in parallel runs."}],"documents":[{"id":62145,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-843/","title":"ZDI-26-843 MLflow SHAP load_explainer","kind":"advisory","source":"analyst","publisher":null,"text":"Fixed in MLflow 3.17.0 (PR 25566). Reported 2026-04-15, published 2026-10-29. CVSS 7.8 AV:L/UI:R.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":62146,"url":"https://github.com/mlflow/mlflow/pull/25566","title":"mlflow PR 25566: Guard mlflow.shap explainer load with MLFLOW_ALLOW_PICKLE_DESERIALIZATION","kind":"other","source":"analyst","publisher":null,"text":"Merged 2026-09-03. mlflow.shap lacked the pickle deserialization guard other flavors enforce via MLFLOW_ALLOW_PICKLE_DESERIALIZATION; adds the same guard. Relates to GHSA-hc9r-hv64-9g82.","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}