CVE-2026-96804
Deferred Deferred - Pending Action

Remote Code Execution in MLflow Statsmodels Flavor

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: CERT/CC

Description
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96804
EUVD
EUVD-2026-85421

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mlflow mlflow From 2.1.0 (inc) to 3.14.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in MLflow's statsmodels flavor (versions 2.1.0 to 3.14.0) allows remote attackers to execute arbitrary code by exploiting a missing security control. The MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False setting is ignored in the _load_model() function, enabling malicious pickle deserialization through crafted MLmodel artifacts.

Detection Guidance

To detect this vulnerability, check if your MLflow installation uses versions 2.1.0 to 3.14.0 and if the statsmodels flavor is in use. Inspect model artifacts for the presence of MLmodel files and verify if the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False control is enforced. No specific commands are provided in the context.

Impact Analysis

An attacker with write access to model storage locations could upload a malicious MLmodel artifact. This could lead to arbitrary code execution on systems running affected MLflow versions, potentially compromising data integrity, confidentiality, or system availability.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR (e.g., Article 32 security of processing) and HIPAA (e.g., Security Rule integrity and confidentiality safeguards). Organizations may face compliance failures if exploited.

Mitigation Strategies

Upgrade MLflow to version 3.15.0 or later to address the statsmodels flaw. Avoid using the dspy flavor until a patch is released. Ensure the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False control is properly enforced for all model flavors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96804. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart