CVE-2026-96775
Deferred Deferred - Pending Action

Remote Code Execution in MLflow DSPy Flavor

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: CERT/CC

Description
MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96775
EUVD
EUVD-2026-85410

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mlflow mlflow From 2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MLflow's dspy flavor versions 2.0 and above. The security control MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False is only enforced when the model_path ends in .pkl. This allows attackers to bypass the control by using crafted MLmodel artifacts, potentially leading to arbitrary code execution.

Impact Analysis

If you use MLflow's dspy flavor with versions >= 2.0, an attacker could exploit this to execute arbitrary code on your system. This could lead to data breaches, unauthorized access, or system compromise if malicious MLmodel artifacts are processed.

Mitigation Strategies

Update MLflow to a version where the security control is applied regardless of file extension. Avoid using .pkl files in MLmodel artifacts. Review and validate all MLmodel artifacts for suspicious content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96775. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart