{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-0596","assignerOrgId":"c09c270a-b464-47c1-9133-acb35b22c19a","state":"PUBLISHED","assignerShortName":"@huntr_ai","dateReserved":"2026-01-05T03:58:44.787Z","datePublished":"2026-03-31T14:25:27.716Z","dateUpdated":"2026-04-01T03:55:35.518Z"},"containers":{"cna":{"title":"Command Injection in mlflow/mlflow","providerMetadata":{"orgId":"c09c270a-b464-47c1-9133-acb35b22c19a","shortName":"@huntr_ai","dateUpdated":"2026-03-31T14:25:27.716Z"},"descriptions":[{"lang":"en","value":"A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacharacters, such as `$()` or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users."}],"affected":[{"vendor":"mlflow","product":"mlflow/mlflow","versions":[{"version":"unspecified","status":"affected","versionType":"custom","lessThanOrEqual":"latest"}]}],"references":[{"url":"https://huntr.com/bounties/2e905add-f9f5-4309-a3db-b17de5981285"}],"metrics":[{"cvssV3_0":{"version":"3.0","attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL"}}],"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command","cweId":"CWE-78"}]}],"source":{"advisory":"2e905add-f9f5-4309-a3db-b17de5981285","discovery":"EXTERNAL"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-31T00:00:00+00:00","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-0596"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-04-01T03:55:35.518Z"}}]}}