CVE-2026-0596: 
Python vulnerability analysis and mitigation

CVE-2026-0596 is a command injection vulnerability in MLflow (mlflow/mlflow) that occurs when serving a model with enable_mlserver=True. The model_uri parameter is embedded directly into a shell command executed via bash -c without proper sanitization, allowing shell metacharacters such as $() or backticks to trigger command substitution. All versions prior to 3.9.0 are affected. The vulnerability was published on March 31, 2026, with a patch released in version 3.9.0. It carries a CVSS v3 base score of 9.6 (Critical) per the GitHub Advisory Database, or 7.8 (High) per NVD's local-vector scoring (GitHub Advisory, Feedly).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where user-controlled input — specifically the model_uri — is concatenated into a shell command string passed to bash -c without sanitization (GitHub Advisory). An attacker who can influence the model_uri value (e.g., by writing a maliciously named model artifact to a directory served by MLflow) can embed shell metacharacters such as $() or backticks to achieve command substitution. Exploitation requires local access and low privileges, but can escalate to the privilege level of the MLflow serving process if that process runs with elevated rights. The fix is tracked in MLflow pull request and commit 202fac4 (GitHub Advisory).

Successful exploitation allows a local attacker to execute arbitrary OS commands with the privileges of the MLflow serving process, resulting in high confidentiality, integrity, and availability impact (GitHub Advisory). If a higher-privileged service (e.g., running as root or a service account) serves models from a directory writable by lower-privileged users, this vulnerability enables privilege escalation (Feedly). The scope of impact can extend beyond the MLflow process itself, potentially enabling lateral movement within the host system.

No confirmed in-the-wild exploitation has been observed as of the time of reporting, and no functional public exploit code has been verified (Feedly). A bounty report exists on Huntr (Huntr), and references to the vulnerability have appeared on Sploitus and Vulners, suggesting early-stage exploit interest. The EPSS score is approximately 0.19% (41st percentile), indicating a relatively low but non-negligible probability of exploitation in the near term (GitHub Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported. Qualys has added detection for this CVE (Feedly).

1. Reconnaissance: Identify a target system running MLflow with model serving enabled (enable_mlserver=True) where the attacker has write access to a directory from which models are served.
2. Craft malicious model_uri: Create a model artifact or directory with a name containing shell metacharacters, such as a path like /shared/models/$(malicious_command) or using backtick syntax to embed an OS command.
3. Trigger model serving: Cause the MLflow service to serve the maliciously named model — either by directly invoking the serve command or by placing the artifact in a location that a higher-privileged automated process will serve.
4. Command execution: When MLflow constructs the shell command string and passes it to bash -c, the embedded metacharacters cause command substitution, executing the attacker's payload with the privileges of the MLflow process.
5. Privilege escalation: If the MLflow service runs as a privileged user, the attacker gains elevated command execution, enabling persistence, data exfiltration, or further lateral movement (GitHub Advisory, Feedly).

• File System: Model artifact directories or filenames containing shell metacharacters ($(), backticks, ;, |) in paths served by MLflow; unexpected scripts or binaries created in MLflow working directories.
• Process: Unusual child processes spawned by the MLflow serving process (e.g., bash, sh, curl, wget, python, nc) that are not part of normal MLflow operation; processes running under the MLflow service account performing unexpected actions.
• Logs: MLflow server logs showing model URIs with shell special characters; OS-level audit logs (e.g., auditd) recording unexpected command execution by the MLflow service user.
• Network: Unexpected outbound connections from the MLflow host to external IPs, particularly on non-standard ports, originating from the MLflow process or its children.

Upgrade MLflow to version 3.9.0 or later, which includes a fix that properly sanitizes the model_uri parameter before embedding it into shell commands (GitHub Advisory). As a workaround for environments that cannot immediately upgrade, disable enable_mlserver=True if MLServer integration is not required. Additionally, restrict write access to directories from which models are served so that only trusted, privileged users can place model artifacts there, preventing untrusted users from injecting malicious URIs (Feedly).

The vulnerability was reported via the Huntr bug bounty platform and credited to researchers ConnorCallison and rotemd-apiiro (GitHub Advisory). The Hacker Wire covered the vulnerability shortly after disclosure, and it was noted on social platforms including Mastodon and Bluesky (Feedly). Red Hat also published a security advisory tracking this CVE. Overall community reaction has been moderate, with no major controversy or widespread alarm given the local-access requirement.