CVE-2026-96804 Details
Description
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
A vulnerability in MLflow's statsmodel flavor, affecting versions 2.1.0 through 3.14.0, allows remote execution of arbitrary code. This issue arises because the flavor completely ignores the security control 'MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False' in the '_load_model()' function. As a result, a remote attacker can execute malicious code by crafting a specific MLmodel artifact that exploits this oversight.
Users should upgrade to MLflow version 3.15.0 or later, where this vulnerability has been patched. For versions prior to 3.15.0, users should avoid loading models via the dspy flavor to prevent pickle deserialization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://kb.cert.org/vuls/id/369093 | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| MLflow | >= 2.1.0, <= 3.14.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |
| Sep 23, 2026 | CVE Modified | CISA-ADP |