CISA issues alert on MLflow pickle deserialization control bypass
2 companies named across 1 category, one of 75 articles referencing GitHub. Previous coverage: CISA includes advisory on Transformers CVE-2026-80047 disk writes prior to consent (Sep 2026).
Companies mentioned
Best suited for
- Seniority
- Director
- Job function
- Cybersecurity / Security Operations
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Buyer journey
- Need to Buy
- Adoption curve
- Early Majority
- Technology maturity
- Market Correction
- Industry
- Information Technology / Software & Services / Cybersecurity / Vulnerability Management & Attack Surface Management
Our classification, not the publisher's statement. Best suited for, not only for.
MLflow’s dspy and statsmodels model flavors contain a vulnerability that can permit unauthorized pickle deserialization executions even when a safety control is used, enabling arbitrary remote code execution in cases described in the advisory.
The advisory describes MLflow as an open-source platform for managing machine learning lifecycles, including model packaging, versioning, and deployment, with “flavors” used to store and load supported models. It says MLflow introduced the MLFLOW_ALLOW_PICKLE_DESERIALIZATION safety control to block and disable executing pickle deserialization and subsequent loads per the user’s choice. It states that when loading models through mlflow.pyfunc.load_model(model), users must specify a model flavor and path in an MLmodel file. For the dspy flavor, MLflow checks MLFLOW_ALLOW_PICKLE_DESERIALIZATION and whether the specified model path ends in .pkl; a path that does not end in .pkl (even if the file is actually a pickle file) routes to a branch that bypasses the safety control, while for the statsmodels flavor, the advisory states there is no check for MLFLOW_ALLOW_PICKLE_DESERIALIZATION. It also states the issue was confirmed against MLflow 3.12.0.
The advisory says exploitation allows arbitrary remote code execution through a malicious pickle-loaded payload, regardless of a user explicitly disallowing pickle serialization, through vulnerable flavor specifications in the MLmodel configuration file. It adds that the attack path requires write access to any location from which a user obtains MLflow models.
MLflow could not be reached to coordinate this vulnerability, and the advisory reports that the statsmodels flavor was patched in versions >= 3.15.0. It says users should upgrade immediately. Until a further fix remedying the dspy flavor vulnerability is available, it states MLflow users who wish to block pickle deserialization and loads should avoid loading any models via the dspy flavor.
The advisory includes acknowledgements for reporting, thanking Prasanna Dabi, and states that the document was written by Alex Lewis. It provides references to MLflow source files for dspy loading and statsmodels, and a related GitHub advisory link.
Blog post, originally published at kb.cert.org.