8.8
High
CVE-2026-96775 MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when…
Description
MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MLflow | 2.0 | No fix stated |
References
- kb.cert.org kb.cert.org
Timeline
- Published
- Last modified
Other CVEs of MLflow
The 38 CVEs of MLflow →
CVE-2026-118628
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
8.2
High
CVE-2026-118627
MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
7.8
High
CVE-2026-118626
MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability
5.4
Medium
CVE-2026-118625
MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability
6.3
Medium