1657 matches found
CVE-2026-96775 MLflow dspy bypasses pickle deserialization control
MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
EUVD-2026-85410
MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
CVE-2026-96775
The MLflow machine learning platform is vulnerable to arbitrary remote code execution (RCE) due to a flaw in the dspy flavor (versions >= 2.0 ). The issue stems from a security control bypass where the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False setting is only enforced if the model_path ends in...
CVE-2026-96775: Deserialization of Untrusted Data
MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
CVE-2026-96804: Deserialization of Untrusted Data
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
PT-2026-97414
Name of the Vulnerable Software and Affected Versions MLflow versions 2.1.0 through 3.14.0 Description The statsmodel flavor in MLflow fails to implement the MLFLOW ALLOW PICKLE DESERIALIZATION=False security control within the load model function. This omission allows a remote attacker to execut...
PT-2026-97413
Name of the Vulnerable Software and Affected Versions MLflow versions 2.0 and later Description The dspy flavor in MLflow incorrectly implements the MLFLOW ALLOW PICKLE DESERIALIZATION=False security control. The control is only applied when the model path ends with the .pkl extension, enabling a...
CLSA-2026-1789728540 TuxCare security update for mlflow (1 CVE)
TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.9.1.post10+tuxcare...
PT-2026-102282
TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.9.1.post10+tuxcare...
BIT-MLFLOW-2026-79721
Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project...
GHSA-JWV3-5HGF-82WW vulnerabilities
Vulnerabilities for packages: mlflow, kserve, az...
CVE-2026-69249 vulnerabilities
Vulnerabilities for packages: mlflow, kserve, az...
CVE-2026-69248 vulnerabilities
Vulnerabilities for packages: mlflow, kserve, az...
GHSA-M2H6-J472-RP4C vulnerabilities
Vulnerabilities for packages: mlflow, kserve, az...
MLflow dspy and statsmodels flavors bypass pickle deserialization control
Overview Two vulnerabilities in MLflow’s dspy and statsmodels model flavors allow unauthorized pickle deserialization executions despite a safety control. Specifically, the dspy flavor conditionally applies the control based on the model path’s file extension, and the statsmodels flavor does not...
CLSA-2026-1789465756 TuxCare security update for mlflow (1 CVE)
TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.9.1.post9+tuxcare...
PT-2026-99026
TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.9.1.post9+tuxcare...
CVE-2026-76220 vulnerabilities
Vulnerabilities for packages: checkov, mlflow...
MLflow AI Gateway permits SSRF through an unvalidated api_base
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
PYSEC-2026-3865 MLflow AI Gateway permits SSRF through an unvalidated api_base
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...