Patch now: critical flaws in MLflow (9.8) and Google’s MCP Toolbox (9.3) put AI servers at risk
Two critical vulnerabilities affect popular AI developer tools: MLflow can be hijacked to run attacker code, and Google's MCP Toolbox for Databases can leak or overwrite server files. Here's who is affected and exactly how to fix them.
If your team builds AI or machine learning projects, two newly disclosed security flaws need your attention today. Both affect popular AI developer tools, and both are rated critical.
- MLflow: CVE-2026-116692, severity 9.8 out of 10
- Google’s MCP Toolbox for Databases: CVE-2026-93328, severity 9.3 out of 10
Here’s what each one does, who’s affected, and how to fix it, step by step.
1. MLflow: CVE-2026-116692 (CVSS 9.8)
What is MLflow?
MLflow is a very popular open-source tool that data science and AI teams use to track experiments, store models and evaluate AI outputs.
What’s the problem?
A flaw in how MLflow loads “scorers” (code used to grade AI outputs) can let an attacker run their own code on the MLflow server. This is called remote code execution (RCE), one of the most serious kinds of bugs.
In simple terms, the attack works like this:
- The attacker uploads a malicious Python file using MLflow’s normal file (artifact) upload feature.
- They then ask MLflow to “run a scorer” using that file.
- Because of the bug, MLflow loads and runs the attacker’s code.
Who is affected?
- MLflow servers before version 3.17.0 (reports list versions from 3.12 onward as affected).
- Servers without login protection are at the highest risk, because no password is needed.
- With basic login enabled, an attacker would need an account allowed to create experiments and upload files.
How to fix it
- Upgrade to MLflow 3.17.0 or later:
pip install --upgrade "mlflow>=3.17.0" - Never expose MLflow directly to the internet. Put it behind a VPN or private network.
- Turn on authentication if you haven’t.
- Check for signs of attack: unexpected Python files in scorer folders, and unusual requests to the
/ajax-api/3.0/mlflow/scorer/invokeendpoint in your logs.
2. Google MCP Toolbox for Databases: CVE-2026-93328 (CVSS 9.3)
What is MCP Toolbox?
MCP (Model Context Protocol) is a standard that lets AI assistants and agents use tools, such as reading databases or files. Google’s open-source MCP Toolbox for Databases connects AI agents to databases and cloud storage.
What’s the problem?
Its cloud-storage tools had no limits on which server folders or storage buckets could be used. An unauthenticated attacker could:
- Copy files from your server to their own Google Cloud Storage bucket (stealing data such as config files or secrets).
- Overwrite files on your server with files from cloud storage.
Who is affected?
Versions 1.2.0 through 1.4.0 that use the cloud-storage source.
How to fix it (two steps, both needed)
- Upgrade to version 1.5.0 or later.
- Set the new allowlists:
allowedLocalRoots(approved server folders) andallowedBuckets(approved cloud buckets). An empty list means no limits, so upgrading without setting these leaves you exposed. Don’t use broad entries such as/.
Also:
- Require authentication and limit who can reach the service.
- Give the Toolbox user and its Google Cloud role only the minimum permissions it needs.
- Review logs and file changes from before you updated, because the update doesn’t undo anything that already happened.
As AI tools get more access to files, databases and servers, a single missing permission check can become a critical security hole.
Are these being attacked right now?
As of the latest reports, neither flaw was on the US government’s list of actively exploited vulnerabilities (CISA KEV), and no confirmed attacks had been reported. But details are public, and researchers have started publishing analysis, so patch quickly.
Quick checklist for AI teams
- ☐ MLflow upgraded to 3.17.0+
- ☐ MLflow not reachable from the public internet
- ☐ MCP Toolbox upgraded to 1.5.0+
- ☐
allowedLocalRootsandallowedBucketsconfigured - ☐ Authentication on for both tools
- ☐ Logs reviewed for suspicious activity
Also read: New attack tricks AI coding agents into installing malware.
Frequently asked questions
What is CVE-2026-116692?
A critical (9.8) remote code execution flaw in MLflow’s third-party scorer loading. It’s fixed in MLflow 3.17.0.
What is CVE-2026-93328?
A critical (9.3) flaw in Google’s MCP Toolbox for Databases that lets attackers copy or overwrite server files through its cloud-storage tools. Fix it by upgrading to 1.5.0+ and setting allowlists.
Is updating MCP Toolbox enough?
No. You must also configure allowedLocalRoots and allowedBuckets. Empty lists leave access unrestricted.
Do these affect regular users?
Not directly. They affect developers and companies running these tools on their servers.
