MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

8.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary MLflow introduced MLFLOWALLOWPICKLEDESERIALIZATION as a security control to prevent unsafe pickle.load execution during model loading, in response to CVE-2024-37052 through CVE-2024-37060. When set to False, operators expect all pickle deserialization to be blocked. The most recent related fix (#21188) patched a bypass in the pyfunc flavor. However, the mlflow.statsmodels flavor completely omits this guard. An attacker who places a crafted MLmodel artifact into any accessible artifact store can trigger arbitrary code execution on any process that calls mlflow.pyfunc.loadmodel() against the malicious model — even when MLFLOWALLOWPICKLEDESERIALIZATION=False. This is a security control bypass. The operator believes pickle RCE is mitigated; the statsmodels flavor silently ignores the control. --- Root Cause mlflow.pyfunc.loadmodel() dispatches to flavor loadpyfunc implementations via: The guarded pattern (from mlflow/sklearn/init.py L526-533, the reference implementation) is:…

Published by the source

1 Sep 2026, 17:04 UTC

Last modified by the source

1 Sep 2026, 17:04 UTC

Source last checked

26 Oct 2026, 13:50 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-gqvg-gmmx-x4hm

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-gqvg-gmmx-x4hm

Advisory: MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
IDs: GHSA-gqvg-gmmx-x4hm
Record: https://patchnext.com/advisories/ghsa-gqvg-gmmx-x4hm (revision 1, source checked 26 Oct 2026, 13:50 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: mlflow 3.15.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI mlflow: affected >= 2.1.0, < 3.15.0; fixed in 3.15.0

## Suggested inspection (read-only)
- `python -m pip show mlflow`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on mlflow.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-gqvg-gmmx-x4hm (GitHub-reviewed advisory GHSA-gqvg-gmmx-x4hm lists affected ranges: PyPI mlflow >=2.1.0 <3.15.0)

Commands are suggestions: review each one before running it.