{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/369093#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nA vulnerability in MLflow’s dspy and statsmodels model flavors allows unauthorized pickle deserialization executions despite a safety control. Specifically, the dspy flavor conditionally applies the control based on the model path’s file extension, and the statsmodels flavor does not apply the control.\r\n\r\n### Description\r\nMLflow is an open-source platform for managing machine learning lifecycles, including model packaging, versioning, and deployment. \"Flavors\" refer to the specialized frameworks through which supported models are stored and loaded. In response to previous vulnerability concerns, MLflow implemented the `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` safety control to block and disable executing any pickle deserialization and subsequent loads per the user’s choice.\r\n\r\nWhen loading models through `mlflow.pyfunc.load_model(model)`, users must specify a model flavor and path in an MLmodel file. With the dspy flavor, MLflow checks the value of `MLFLOW_ALLOW_PICKLE_DESERIALIZATION`, and whether the specified model path ends in `.pkl`. A model path that does not end in `.pkl` (even if the file is actually a pickle file), will route to a separate branch for pickle deserialization, bypassing the safety control. However, when loading through the statsmodels flavor, there is no check for `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` at all.\r\n\r\n### Impact\r\nExploitation of this vulnerability allows for arbitrary remote code execution through a malicious pickle-loaded payload, regardless of a user explicitly disallowing pickle serialization, through vulnerable flavor specifications in the MLmodel configuration file. The attack path requires write access to any location from which a user obtains MLflow models. This vulnerability was confirmed against MLflow 3.12.0.\r\n\r\n### Solution\r\nMLFlow could not be reached to coordinate this vulnerability; however, the statsmodels flavor was patched in versions >= 3.15.0. Users should upgrade immediately. Until a further fix remedying the dspy flavor vulnerability is available, MLflow users who wish to block pickle deserialization and loads should avoid loading any models via the dspy flavor.\r\n\r\n### Acknowledgements\r\nThanks to Prasanna Dabi for reporting this vulnerability. This document was written by Alex Lewis.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/369093"},{"url":"https://github.com/mlflow/mlflow/blob/master/mlflow/dspy/load.py","summary":"https://github.com/mlflow/mlflow/blob/master/mlflow/dspy/load.py"},{"url":"https://github.com/mlflow/mlflow/blob/master/mlflow/statsmodels/__init__.py","summary":"https://github.com/mlflow/mlflow/blob/master/mlflow/statsmodels/__init__.py"},{"url":"https://github.com/advisories/GHSA-gqvg-gmmx-x4hm","summary":"https://github.com/advisories/GHSA-gqvg-gmmx-x4hm"}],"title":"MLflow dspy and statsmodels flavors bypass pickle deserialization control","tracking":{"current_release_date":"2026-09-16T17:10:46+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.48"}},"id":"VU#369093","initial_release_date":"2026-09-16 17:10:46.009626+00:00","revision_history":[{"date":"2026-09-16T17:10:46+00:00","number":"1.20260916171046.1","summary":"Released on 2026-09-16T17:10:46+00:00"}],"status":"final","version":"1.20260916171046.1"}},"vulnerabilities":[{"title":"mlflow/statsmodels/__init__.","notes":[{"category":"summary","text":"mlflow/statsmodels/__init__.py in MLflow (mlflow project), versions >= 2.1.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#369093"}]},{"title":"mlflow/dspy/load.","notes":[{"category":"summary","text":"mlflow/dspy/load.py in MLflow (mlflow project), versions >= 2.0,  applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#369093"}]}],"product_tree":{"branches":[]}}