Description
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MLflow | MLflow | 2.1 – < 3.15.0 | 3.15.0 |
Advisories 1
- WID-SEC-2026-3562 MLflow: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Sep 23, 2026