Command Injection in mlflow/mlflow
CVE-2026-0596 has a selected CVSS score of 7.8 (high); EIP currently links 1 repository PoC and 1 lab environment.
A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacharacters, such as `$()` or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users.
| Product | Source | Version range | Status |
|---|---|---|---|
mlflow/mlflowBrowse mlflow / mlflow/mlflow | CVE List | Through latest | affected |
mlflowBrowse PyPI / mlflow | GitHub Advisory | Before 3.9.0 · Fixed in 3.9.0 | affected |
The artifact is a technical writeup (README.md) that documents an attempt to reproduce CVE-2026-0596, a command injection vulnerability in MLflow. The writeup reports that the initial command injection vector via API parameters failed, and instead demonstrates a separate insecure deserialization attack using a pickle payload. The repository also contains a scanner script (verify_poc.py) that tests the original command injection vector, but the primary artifact is the writeup itself.
No backdoor observed in reviewed code
The repository contains a PoC for CVE-2026-0596, demonstrating command injection and insecure deserialization in MLflow. All provided scripts (Dockerfile, generate_model.py, trigger_native.py, verify_poc.py) perform expected vulnerability reproduction tasks: building a vulnerable environment, creating a malicious pickle payload, and sending a crafted HTTP request. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the reviewed text.
The primary file is a 194-line README.md that provides a structured vulnerability research report, including architectural analysis, test results, and mitigation strategies. It does not contain executable exploit code that directly triggers the CVE-2026-0596 command injection; instead, it documents a failed attempt and pivots to a different vulnerability class. The repository also includes a scanner script (verify_poc.py) that sends a payload to test the original injection vector, but the artifact as a whole is best classified as a writeup.
README.md:1-194verify_poc.py:1-41README.md:26-28README.md:116-117README.md:93-110README.md:114-167README.md:93-167verify_poc.py:1-41This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A Docker Compose environment that builds and runs an MLflow model server (v2.11.1) with MLServer (v1.3.5) enabled, serving a dummy pyfunc model on port 5000. The README describes it as a reproduction lab for CVE-2026-0596, focusing on insecure deserialization via pickle.
docker-compose.yml:1-7Dockerfile:1-20README.md:1-10The README explicitly states the environment is a laboratory to evaluate CVE-2026-0596, describing a containerized setup with specific vulnerable framework versions and reproduction steps. The Dockerfile pins mlflow==2.11.1 and mlserver==1.3.5, and the README details exploit verification via pickle deserialization.
README.md:1-10Dockerfile:10A container built from the local Dockerfile, running 'mlflow models serve' with --enable-mlserver on port 5000. It serves a dummy pyfunc model generated by generate_model.py.
docker-compose.yml:2-7Dockerfile:10A Python script copied into the image and executed at build time to create a minimal MLflow pyfunc model at /app/saved_model using mlflow.pyfunc.save_model.
Dockerfile:13-16generate_model.py:1-20A standalone script that serializes a malicious pickle payload using __reduce__ to execute 'touch /tmp/native_success_marker.txt' upon deserialization, then simulates loading it. It is not part of the container build or service; the README instructs copying it into the running container and executing it manually.
trigger_native.py:1-29README.md:100-115A script that sends a POST request to the model server with a shell injection payload in the 'params' field, attempting to create /tmp/poc_success_marker.txt. The README notes this test cycle returned negative (no command injection).
verify_poc.py:1-41README.md:80-90Insufficient evidence
The README associates CVE-2026-0596 with the lab, but the visible evidence does not demonstrate the claimed vulnerability. The Dockerfile pins mlflow==2.11.1 and mlserver==1.3.5, and the README describes a pickle deserialization exploit, but no actual exploit against the running service is shown. The verify_poc.py script attempts command injection (CWE-78) and fails, while trigger_native.py demonstrates generic pickle deserialization outside the service context. The connection between the CVE and the specific service behavior is not established by the supplied artifacts.
README.md:1-10Dockerfile:10verify_poc.py:1-41trigger_native.py:1-29docker-compose.yml:1-7verify_poc.py:4README.md:100-115docker-compose.yml:1-7verify_poc.py:1-41README.md:80-90README.md:100-115trigger_native.py:1-29README.md:115-120All visible behavior is directed at the lab's own container. The Dockerfile builds a model server, the Compose file maps port 5000, and the exploit scripts target the container's filesystem (/tmp) or the local service. No evidence of host escape, external connectivity, persistence, credential theft, or destructive actions is present. The README explicitly describes the lab purpose and steps.
docker-compose.yml:1-7Dockerfile:1-20trigger_native.py:1-29verify_poc.py:1-41README.md:1-194This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.