Description
MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MLflow | MLflow | 2.0 | — |
Advisories 1
- WID-SEC-2026-3562 MLflow: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Sep 23, 2026