{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15379.json" } ], "title": "mlflow: MLflow: Arbitrary command execution via command injection in model serving container initialization.", "tracking": { "current_release_date": "2026-09-04T20:27:31+00:00", "generator": { "date": "2026-09-04T20:27:31+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.16" } }, "id": "CVE-2025-15379", "initial_release_date": "2025-01-01T00:00:00+00:00", "revision_history": [ { "date": "2025-01-01T00:00:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-09-04T20:10:07+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-09-04T20:27:31+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift AI (RHOAI)", "product": { "name": "Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai)", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_ai" } } } ], "category": "product_family", "name": "Red Hat OpenShift AI (RHOAI)" }, { "category": "product_version", "name": "rhoai/odh-mlflow-rhel9", "product": { "name": "rhoai/odh-mlflow-rhel9", "product_id": "rhoai/odh-mlflow-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-mlflow-rhel9?repository_url=quay.io/rhoai/odh-mlflow-rhel9/odh-mlflow-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-training-cuda128-torch29-py312-rhel9", "product": { "name": "rhoai/odh-training-cuda128-torch29-py312-rhel9", "product_id": "rhoai/odh-training-cuda128-torch29-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-training-cuda128-torch29-py312-rhel9?repository_url=quay.io/rhoai/odh-training-cuda128-torch29-py312-rhel9/odh-training-cuda128-torch29-py312-rhel9" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-mlflow-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-mlflow-rhel9" }, "product_reference": "rhoai/odh-mlflow-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-training-cuda128-torch29-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-training-cuda128-torch29-py312-rhel9" }, "product_reference": "rhoai/odh-training-cuda128-torch29-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-15379", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "discovery_date": "2026-03-30T08:01:15.603463+00:00", "flags": [ { "label": "vulnerable_code_not_in_execute_path", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-mlflow-rhel9" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2452949" } ], "notes": [ { "category": "description", "text": "A flaw was found in MLflow. When deploying a model with `env_manager=LOCAL`, MLflow's model serving container initialization code, specifically the `_install_model_dependencies_to_env()` function, reads dependency specifications from the model artifact's `python_env.yaml` file. An attacker can supply a malicious model artifact, leading to command injection as these specifications are directly interpolated into a shell command without proper sanitization. This allows for arbitrary command execution on systems deploying the malicious model.", "title": "Vulnerability description" }, { "category": "summary", "text": "mlflow: MLflow: Arbitrary command execution via command injection in model serving container initialization.", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability in MLflow allows for arbitrary command execution when deploying a model with `env_manager=LOCAL`. An attacker can supply a malicious model artifact containing a crafted `python_env.yaml` file, leading to command injection during container initialization. During the deployment of the model MLflow passes the maliciously crafted requirement string to the shell command without properly sanitization of possible command injections, as consequence the attacker may be able to execute arbitrary code at the same permission level as the user running the MLflow process.\n\nRed Hat Product Security team has rated this vulnerability as having the impact of Important. Although it allows arbitrary code to successfully exploit this flaw the attacker depends on MLFlow having a non-default deployment option (env_manager=LOCAL), besides requiring enough privileges and access to deploy the malicious model or trick the user to download and deploy the malicious model.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-training-cuda128-torch29-py312-rhel9" ], "known_not_affected": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-mlflow-rhel9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2025-15379" }, { "category": "external", "summary": "RHBZ#2452949", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452949" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2025-15379", "url": "https://www.cve.org/CVERecord?id=CVE-2025-15379" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15379", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15379" }, { "category": "external", "summary": "https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05e", "url": "https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05e" }, { "category": "external", "summary": "https://huntr.com/bounties/dc9c1c20-7879-4050-87df-4d095fe5ca75", "url": "https://huntr.com/bounties/dc9c1c20-7879-4050-87df-4d095fe5ca75" } ], "release_date": "2026-03-30T07:16:57.610000+00:00", "remediations": [ { "category": "workaround", "details": "To mitigate this issue, avoid deploying MLflow models with `env_manager=LOCAL`. If using `env_manager=LOCAL` is unavoidable, ensure that all model artifacts, particularly their `python_env.yaml` files, originate from trusted sources and are thoroughly vetted for malicious content. This operational control helps prevent the injection of arbitrary commands during model serving container initialization.", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-training-cuda128-torch29-py312-rhel9" ] }, { "category": "none_available", "details": "Affected", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-training-cuda128-torch29-py312-rhel9" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-mlflow-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-training-cuda128-torch29-py312-rhel9" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-mlflow-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-training-cuda128-torch29-py312-rhel9" ] } ], "title": "mlflow: MLflow: Arbitrary command execution via command injection in model serving container initialization." } ] }