9256 matches found
CVE-2026-96804 CVE-2026-96804
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
abnativ (>=1.1.0, <=1.2.9), ai-24sea (>=0.1.0, <=1.1.0) +204 more potentially affected by CVE-2026-96775 via mlflow (>=2.18.0, <=3.12.0)
mlflow PYPI version =2.18.0, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =1.7.0.dev1715243074, =1.7.0.dev1715246371, =1.8.0rc6, =1.7.0.dev1715246329, =1.7.0.dev1715246310, =0.1.9, =0.1.40 and more Source cves: CVE-2026-96775 Source advisory: MEND:CVE-2026-96775...
CVE-2026-96775 MLflow dspy bypasses pickle deserialization control
MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
abnativ (>=1.1.0, <=1.2.9), ai-24sea (>=0.1.0, <=1.1.0) +234 more potentially affected by CVE-2026-96775 via mlflow-skinny (>=2.18.0rc0, <=3.13.0rc0)
mlflow-skinny PYPI version =2.18.0rc0, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =1.7.0.dev1715243074, =1.7.0.dev1715246371, =1.8.0rc6, =1.7.0.dev1715246329, =1.7.0.dev1715246310, =0.1.9, =0.1.40 and more Source cves: CVE-2026-96775 Source advisory: MEND:CVE-2026-96775...
EUVD-2026-85410
MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
CVE-2026-96775 MLflow dspy bypasses pickle deserialization control
MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
CVE-2026-96775
The MLflow machine learning platform is vulnerable to arbitrary remote code execution (RCE) due to a flaw in the dspy flavor (versions >= 2.0 ). The issue stems from a security control bypass where the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False setting is only enforced if the model_path ends in...
CVE-2026-96804: Deserialization of Untrusted Data
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
CVE-2026-96775: Deserialization of Untrusted Data
MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
PT-2026-97414
Name of the Vulnerable Software and Affected Versions MLflow versions 2.1.0 through 3.14.0 Description The statsmodel flavor in MLflow fails to implement the MLFLOW ALLOW PICKLE DESERIALIZATION=False security control within the load model function. This omission allows a remote attacker to execut...
PT-2026-97413
Name of the Vulnerable Software and Affected Versions MLflow versions 2.0 and later Description The dspy flavor in MLflow incorrectly implements the MLFLOW ALLOW PICKLE DESERIALIZATION=False security control. The control is only applied when the model path ends with the .pkl extension, enabling a...
CLSA-2026-1789728540 TuxCare security update for mlflow (1 CVE)
TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.9.1.post10+tuxcare...
PT-2026-102282
TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.9.1.post10+tuxcare...
BIT-MLFLOW-2026-79721
Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project...
kedro-azureml (0.9.0), kedro-graphql (>=1.1.0, <=1.5.1) +4 more potentially affected by CVE-2026-62997 via kedro-datasets (7.0.0)
kedro-datasets PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on kedro-datasets and may be impacted: - kedro-azureml 0.9.0 - kedro-graphql =1.1.0, =0.12.2, =0.7.0, =0.1.0, =0.1.3 Source cves: CVE-2026-62997 Source advisory:...
CVE-2026-69249 vulnerabilities
Vulnerabilities for packages: kserve, az, mlflow...
GHSA-JWV3-5HGF-82WW vulnerabilities
Vulnerabilities for packages: kserve, az, mlflow...
GHSA-M2H6-J472-RP4C vulnerabilities
Vulnerabilities for packages: kserve, az, mlflow...
CVE-2026-69248 vulnerabilities
Vulnerabilities for packages: kserve, az, mlflow...
MLflow dspy and statsmodels flavors bypass pickle deserialization control
Overview Two vulnerabilities in MLflow’s dspy and statsmodels model flavors allow unauthorized pickle deserialization executions despite a safety control. Specifically, the dspy flavor conditionally applies the control based on the model path’s file extension, and the statsmodels flavor does not...