MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

Summary

MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously.

An HTTP caller can combine this behavior with MLflow's built-in experiment, run, and artifact-upload endpoints:

1. Create an experiment whose local artifact location points to a writable allowed scorer package.
2. Create a run, causing MLflow to allocate <artifact_location>/<run_id>/artifacts/.
3. Upload a Python module into that run artifact directory.
4. Submit a serialized third-party scorer whose module path resolves to the uploaded file.
5. Trigger server-side import and class construction through /ajax-api/3.0/mlflow/scorer/invoke.

On the default no-auth server using the official MLflow v3.14.0 image, this produces unauthenticated arbitrary Python code execution with the privileges of the MLflow server process. The reproduced image runs the process as uid 0 and permits writes to its installed Python package tree.

The attached proof of concept is intentionally harmless. The uploaded constructor performs one action only: it writes a random marker beside its own uploaded run artifact. The marker is then downloaded through MLflow's run-artifact endpoint and checked for an exact match.

Technical details

1. The allow-list accepts attacker-created descendants

At release commit 86cd7f5a1dc25a1387ad07c87811bbc30f62951c, mlflow/genai/scorers/scorer_utils.py defines these allowed roots:

THIRD_PARTY_SCORER_ALLOWED_MODULES = frozenset({
    "mlflow.genai.scorers.ragas",
    "mlflow.genai.scorers.deepeval",
    "mlflow.genai.scorers.trulens",
    "mlflow.genai.scorers.phoenix",
})