Brief · Builders

Your AI Servers Answer Anyone.

By alkizz · Oct 29, 2026

The worst AI-infrastructure bugs in this week's advisories weren't clever attacks on models, they were servers that do what they're told by whoever happens to be talking to them. MLflow and NVIDIA's NeMo Agent Toolkit got critical CVEs on Oct 27, and the same day GitHub's advisory database added a critical Agno bug whose CVE dates from April. Every fix was already on PyPI before the advisory went out, so for most people this is less a fire drill and more a "did you actually upgrade" week. None of these CVEs is in CISA's KEV catalog (version 2026.10.28), but honeypot operator Previdian says it has seen exploitation attempts against the MLflow file-read bug, CVE-2026-116690, since Oct 27. I haven't seen exploitation of the others reported.

What's actually confirmed

• MLflow, CVE-2026-116692 (CVSS 9.8). From 3.12.0 until 3.17.0, a caller can upload a Python file as a run artifact and then get the server to import and run it. mlflow server has no authentication by default, so that takes no credentials, and basic auth only narrows it to users who can create experiments and runs and upload artifacts. The server has to be able to write to its own package tree, but the researcher's reproduction used the official v3.14.0 image, which runs as root and can. Its sibling, CVE-2026-116690 (7.5), lets an unauthenticated caller read files the server can read. Both are fixed in 3.17.0, out since Oct 7.
• NeMo Agent Toolkit, CVE-2026-65145 (CVSS 10.0). NVIDIA calls it missing authentication in 1.0 to 1.8.0 that "might lead to code execution," fixed in 1.9.0, and doesn't say what the missing auth was on. The PyPI package nvidia-nat has had 1.9.0 since Sep 10, and Severity Daily notes the CVE record's version range is free text, so your scanner may not flag a 1.8.0 pin.
• Agno, CVE-2026-35002 (Critical). Not a missing password, but the same idea: before 2.3.24, a tool-call field called field_type went straight into Python's eval(), so per Agno's advisory anything that can influence it, including "untrusted tool/model output," can run Python in the Agno process. 2.3.24 has been out since Jan 8.

My take: none of this needed AI to go wrong. It's the PoeLLM and LLMjacking lesson again, and attackers don't have to outsmart your agent stack if it takes orders from strangers.

What to do:

• Upgrade, and check your pins.

  • Why: the fixes are weeks or months old, and a quiet scanner doesn't prove much here.
  • How: run pip show mlflow nvidia-nat agno and get to mlflow 3.17.0, nvidia-nat 1.9.0 and agno 2.3.24 or later. Grep your lockfiles and container images too, not just the box you're on.

• Put auth in front of MLflow.

  • Why: the default server answers anyone, and both MLflow bugs are worst when nobody has to log in.
  • How: start it with mlflow server --app-name basic-auth (per MLflow's docs) or put it behind a proxy that requires a login, alongside the upgrade, not instead of it. My suggestion, not vendor guidance: don't run it as root.

• Keep these servers off the internet.

  • Why: the MLflow and NeMo bugs need someone to reach the server first. Agno's can also arrive through tool or model output, so for Agno the upgrade is the fix.
  • How: bind to localhost, and in Docker publish with -p 127.0.0.1:<port>:<port>, since Docker's docs warn that plain -p is "insecure by default." My suggestion: if you need it remotely, use a VPN, not an open port.

• If an old MLflow was reachable, look before you upgrade.

  • Why: the upgrade closes the hole but won't tell you if someone already used it.
  • How (my suggestion, based on the advisories' steps): check access logs for POSTs to /ajax-api/3.0/mlflow/scorer/invoke and experiments whose artifact location sits inside site-packages, and, for the file-read bug, requests to /api/2.0/mlflow/model-versions/get-artifact and model versions tagged mlflow.prompt.is_prompt with a relative source path. Treat a hit as a compromised host and rotate what it could read.

Sources

• GitHub Advisory GHSA-26p8-2jq9-3vq9 / CVE-2026-116692 (MLflow scorer RCE)
• OSV: CVE-2026-116692 (CVE record text, CVSS vector)
• GitHub Advisory GHSA-m65p-9j7q-6w33 / CVE-2026-116690 (MLflow file read)
• OSV: CVE-2026-116690
• Previdian: CVE-2026-116690 exploitation attempts observed
• MLflow 3.17.0 release (Oct 7, 2026)
• MLflow docs: basic HTTP authentication
• NVIDIA Security Bulletin 5912: NeMo Agent Toolkit, October 2026
• PyPI: nvidia-nat 1.9.0
• Severity Daily: NeMo Agent Toolkit CVE-2026-65145, fix on PyPI since September 10
• Agno advisory GHSA-m4w4-3r8h-jw98 / CVE-2026-35002
• PyPI: agno 2.3.24
• Corgea: Agno, LiteLLM, Hydra, vLLM and NeMo Agent Toolkit advisories (Oct 27, 2026)
• Rosetta Daily, Oct 28, 2026
• Docker docs: port publishing
• CISA Known Exploited Vulnerabilities catalog (JSON)

← All briefs