CVE-2026-0596

Description

Mlflow: Command Injection when serving models with enable_mlserver=True

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-0596
• https://github.com/mlflow/mlflow/pull/19738
• https://github.com/mlflow/mlflow/commit/202fac4c83ccc8544c087c142b80196d0e60695c
• https://github.com/mlflow/mlflow
• https://huntr.com/bounties/2e905add-f9f5-4309-a3db-b17de5981285
• https://github.com/advisories/GHSA-rvhj-8chj-8v3c