6 matches found
CVE-2026-96804
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
CVE-2026-96804 CVE-2026-96804
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
CVE-2026-96804
The MLflow machine learning platform (versions 2.1.0 to 3.14.0 ) contains a vulnerability in its statsmodels flavor component. The _load_model() function fails to enforce the MLFLOW_ALLOW_PICKLE_DESERIALIZATION security control, allowing an attacker to execute arbitrary code by submitting a speci...
CVE-2026-96804 CVE-2026-96804
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
EUVD-2026-85421
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...
CVE-2026-96804: Deserialization of Untrusted Data
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...