Remote Code Execution in MLflow SHAP load_explainer (CVE‑2026‑118627) Threatens ML Model Deployment
What It Is — A deserialization flaw in the SHAP explainer loading routine of MLflow (CVE‑2026‑118627) permits an attacker to execute arbitrary code on the host running MLflow. The vulnerability is triggered when a user‑controlled SHAP model file is loaded; no authentication is required, and user interaction is limited to visiting a malicious page or opening a crafted file. CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) classifies it as a high‑severity remote code execution issue. The flaw was reported on 15 April 2026, publicly disclosed on 29 October 2026, and has been patched in MLflow 3.17.0.
Affected Products — MLflow (all versions prior to 3.17.0).
Why It Matters for Trust & Control Assurance — The issue highlights the need for robust input‑validation and secure‑coding controls, a core control objective that maps to many frameworks (e.g., NIST CSF Identify & Protect). Capability: Control‑mapping to evidence‑based remediation.
Recommended Actions —
- Upgrade to MLflow 3.17.0 or later.
- Apply strict validation/sanitization of any SHAP explainer files before loading.
- Incorporate deserialization testing into CI/CD pipelines and retain remediation evidence for audit.
- Document the fix and update your secure‑development policy.
Source: Zero Day Initiative advisory