MLflow Vulnerability Allows Remote Code Execution via Deserialization Flaw
A deserialization vulnerability in MLflow's PickleEvaluationArtifact component enables remote code execution, with a CVSS score of 7.8.
A critical deserialization vulnerability has been identified in MLflow, a popular open-source platform for managing the machine learning lifecycle. The flaw, detailed in advisory ZDI-26-839 and assigned CVE-2026-118623, allows remote attackers to execute arbitrary code on affected systems.
The vulnerability resides within the PickleEvaluationArtifact component of MLflow. Specifically, the issue stems from improper validation of user-supplied data during the parsing of pickle files. This lack of validation permits an attacker to trigger the deserialization of untrusted data, leading to the execution of malicious code within the context of the MLflow process.
Exploitation of this vulnerability requires a degree of user interaction. Attackers must trick a user into visiting a malicious webpage or opening a specially crafted file that contains the malicious pickle data. Once the user interacts with the malicious content, the deserialization process can be initiated, allowing the attacker to achieve code execution.
The severity of this vulnerability is underscored by its CVSS score of 7.8, classifying it as High. This score reflects the potential for significant impact, including complete system compromise if the MLflow process is running with elevated privileges.
Fortunately, the vulnerability has been addressed by the MLflow development team. The issue was fixed in MLflow version 3.13.0, with the corresponding pull request (PR #23183) available on GitHub. Users are strongly advised to update to the patched version as soon as possible to mitigate the risk of exploitation.
The disclosure timeline indicates that the vulnerability was initially reported to the vendor on March 25, 2026. Following a coordinated disclosure process, the advisory was publicly released on October 29, 2026, with an update to the advisory also published on the same date. The credit for discovering this vulnerability has been attributed to 'Anonymous'.
This finding highlights the ongoing risks associated with deserialization vulnerabilities, particularly in platforms that handle complex data formats like pickle. Developers must prioritize robust input validation and consider safer serialization methods to prevent such critical security flaws from impacting their users.
This new advisory from Zero Day Initiative details a distinct Server-Side Request Forgery (SSRF) vulnerability, ZDI-26-847, affecting MLflow AI Gateway. Unlike the previously reported deserialization flaw leading to RCE, this SSRF vulnerability allows authenticated remote attackers to initiate arbitrary server-side requests by exploiting improper URI validation in the api_base field, with a CVSS score of 7.7.
This new advisory from Zero Day Initiative specifically details a remote code execution vulnerability within MLflow's SHAP load_explainer function, stemming from the deserialization of untrusted data. The vulnerability, assigned CVE-2026-118627, requires user interaction and carries a CVSS score of 7.8, differing from the previously reported PickleEvaluationArtifact flaw.
This advisory, ZDI-26-845, specifically details a deserialization vulnerability within MLflow's Statsmodels _load_model component, differing from the previously reported PickleEvaluationArtifact flaw. The vulnerability, assigned CVE-2024-37052, allows for remote code execution when users interact with malicious content, and has been fixed in MLflow version 3.15.0.