MLflow RCE CVE-2026-116692 (CVSS 9.8), Google's MCP Toolbox file-exfiltration flaw and a critical LiteLLM advisory: which versions fix them

The MLflow RCE CVE that security feeds flagged on October 27, 2026 is CVE-2026-116692: a remote code execution flaw in how MLflow servers load third-party scorers, rated CVSS 9.8 and fixed in MLflow 3.17.0. It landed in a busy two days for AI infrastructure security. On October 26, Google's CVE numbering authority published CVE-2026-93328, a file-exfiltration bug in its open-source MCP Toolbox for Databases, and on October 27 LiteLLM disclosed a CVSS 10.0 flaw in its Enterprise proxy, six days after its 1.107.0 release was poisoned on PyPI. All three have fixes. For Toolbox, though, upgrading isn't enough on its own.

This story is based on the GitHub security advisories for MLflow and LiteLLM, the CVE.org and NVD records, Google's CVE record and the MCP Toolbox pull request, release notes and documentation, the projects' release pages and PyPI, and Wiz's October 27 PHP2Shell post, checked October 28 and 29, 2026.

The short version

• MLflow: CVE-2026-116692, CVSS 9.8, affects 3.12.0rc0 up to 3.17.0. Fixed in 3.17.0 (October 7); the latest release is 3.17.2.
• Google MCP Toolbox for Databases: CVE-2026-93328, CVSS v4.0 9.3, affects 1.2.0 to 1.4.0. Version 1.5.0 adds bucket and folder allowlists, which you must set.
• LiteLLM: GHSA-w4c7-34wj-hqm8, CVSS 10.0, Enterprise-licensed proxies only. Fixed in 1.103.10, 1.104.8, 1.105.6 and 1.106.5. No CVE yet.
• Exploitation: no exploitation has been reported. The NVD records for the MLflow, Toolbox and LiteLLM CVEs showed no Known Exploited Vulnerabilities listing on October 29, and CISA's October 26 assessment of the Toolbox flaw lists exploitation as "none."
• PHP2Shell update: CISA added both PHP2Shell CVEs to that catalog on October 26, and Wiz published new exploitation data on October 27 (below).

What is the MLflow RCE, CVE-2026-116692?

It's a code-injection bug in the third-party scorer feature MLflow added in version 3.12.0. MLflow's GitHub advisory, GHSA-26p8-2jq9-3vq9, says the server imported whatever module a request named, as long as it sat under one of four allowed package prefixes. The check accepted any sub-module, so an attacker who could write a file under an allowed package could get it imported, and its code run.

The advisory describes a chain built only from MLflow's public endpoints: create an experiment and a run, upload an artifact that lands inside an allowed package, then call the scorer endpoint to import it. The reporter, credited as mskca, ran a harmless proof of concept as root on the official MLflow 3.14.0 container image.

Who is exposed depends on configuration, according to the advisory:

• No authentication, which the advisory calls the default: any network caller who can reach the tracking server, with no credentials.
• With authentication: any user allowed to create experiments and runs and upload artifacts.
• Not exploitable this way if the container filesystem is read-only, or if the scorer package directory isn't writable by the server process.

The timing is unusual. MLflow shipped the fix in 3.17.0 on October 7 ("Match third-party scorer modules exactly instead of by package prefix"), published the advisory on October 9, and the CVE record appeared on October 27. The same release fixed a dozen other GitHub advisories, including a moderate scorer SSRF now tracked as CVE-2026-115886. MLflow has since shipped 3.17.1 (October 13) and 3.17.2 (October 21), PyPI shows.

What is the Google MCP Toolbox bug, CVE-2026-93328?

MCP Toolbox for Databases is an open-source Model Context Protocol server from Google Cloud that gives AI agents tools for databases and, since version 1.2.0 in May 2026, Cloud Storage. Google Cloud's CVE record says its Cloud Storage source, in versions 1.2.0 through 1.4.0, has path traversal and missing authorization flaws that let "an unauthenticated remote attacker" copy host files to outside Cloud Storage buckets and overwrite local files through crafted tool parameters. It scores CVSS v4.0 9.3 and credits He Wei (gikaku).

The fix, pull request #3454, shipped in Toolbox 1.5.0 on June 18, 2026, four months before the CVE. It adds two settings, allowedBuckets and allowedLocalRoots. The pull request says they default to allow all, and the current documentation confirms it: "If allowedLocalRoots is omitted, every absolute path the server process can reach is allowed." Google's CVE record lists three steps: upgrade to 1.5.0 or later, set both allowlists, and run Toolbox under an unprivileged account with narrow IAM permissions.

The docs also list limits. Symbolic links are resolved, but hard links "are indistinguishable from ordinary files," and the check runs just before a file is opened, which leaves a small race window. Google tells users to treat the allowlist "as a guardrail layered on top of OS permissions rather than a replacement for them."

What did LiteLLM disclose on October 27?

An advisory titled "Unauthenticated file read leaks master key on Enterprise proxy," GHSA-w4c7-34wj-hqm8, rated CVSS 10.0. It says an unauthenticated request to any model route on a proxy running with an Enterprise license could make it read a local file and send it to an attacker's URL. Reading the process environment exposes LITELLM_MASTER_KEY and provider API keys, and in some setups leads to running Python as root. "Open source deployments without a license are not affected," the advisory says. It credits Dylan Ong of Karmasec and, independently, Cyrill Bannwart of Compass Security.

LiteLLM's October 21 incident post had said an "embargoed release that remediates a vulnerability" was going to Enterprise customers, with disclosure "scheduled for October 27." The post doesn't name the advisory, but the dates match. Version 1.106.5 reached GitHub and PyPI on October 27. LiteLLM shipped 1.106.6 on October 28 with a compression fix; 1.106.5 remains the first fixed version on that line.

A second LiteLLM advisory reached the CVE list on October 22: CVE-2026-114612, which lets a user with internal_user rights become proxy_admin and run commands. Its scores conflict. The CVE record, filed through GitHub, and LiteLLM's own advisory, published September 30, give CVSS 3.1 9.9 (Critical); GitHub's reviewed Advisory Database entry, added October 27, rates it High with a CVSS 4.0 score of 7.7. It affects 1.91.0 up to 1.100.4 plus early builds of the 1.101 to 1.104 lines, with fixes in 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0rc2, so its affected ranges stop before the 1.105 and 1.106 lines. Note that 1.106.2, the version LiteLLM told users to pin after the 1.107.0 compromise, is still affected by the Enterprise flaw; Enterprise users need 1.106.5. The bigger LiteLLM risk in October 2026 remains the 1.107.0 supply-chain compromise: LiteLLM's October 23 write-up traced it to a master key committed to a public repository in May and never revoked. Exposed LiteLLM servers have also been botnet targets, as our PoeLLM story reported.

Which versions fix MLflow, MCP Toolbox and LiteLLM?

Last verified: October 29, 2026

Other projects had critical fixes the same week. GitLab patched CVE-2026-110264, a CVSS 10.0 flaw, on October 21, and the Brotli decoder bug known as HTTP2Shell is still working its way through runtimes and proxies.

What's new on PHP2Shell?

On October 26, CISA added both PHP2Shell CVEs, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog, with an October 29 deadline for federal agencies, according to their NVD records. When our PHP2Shell story was last checked on October 23, neither was listed.

Wiz's October 27 post supplies the evidence behind that. Wiz says it has "not yet observed successful end-to-end PHP2Shell exploitation" in its own telemetry, and that most attempts against its honeypots failed partway through. But on October 24 two of those sources "did successfully exploit Adel Karimi's honeypot," which Wiz calls a likely factor in CISA's decision. The honeypot report, published on GitHub, logs 35 shells opened on three PHP 8.4.26 targets. Its author notes the targets used an "intentionally favorable" single-worker Apache mod_php setup.

Wiz also reports remediation progress. The daily number of internet-exposed vulnerable machines it sees fell about 67% in a few days, and "less than 53% of initially affected organizations" were still vulnerable a week after disclosure. These figures cover Wiz's customers only, and Wiz says they don't show whether machines were patched, retired or firewalled.

What's confirmed, reported and uncertain

• Confirmed (advisories, CVE records, release notes): all CVE and advisory IDs, scores, affected and fixed versions in the table; the Toolbox allowlist defaults; LiteLLM's Enterprise-only scope; the PHP2Shell KEV dates.
• Reported (Wiz and a honeypot operator): PHP2Shell exploitation on one operator's honeypots, and Wiz's remediation trends.
• Uncertain: whether anyone has exploited the MLflow, Toolbox or LiteLLM flaws; whether GHSA-w4c7-34wj-hqm8 is the embargoed fix LiteLLM described; which score for CVE-2026-114612 will stand.