CVE-2026-96804

Name of the Vulnerable Software and Affected Versions MLflow versions 2.1.0 through 3.14.0

Description The statsmodel flavor in MLflow fails to implement the MLFLOW ALLOW PICKLE DESERIALIZATION=False security control within the load model() function. This omission allows a remote attacker to execute arbitrary code by providing a specially crafted MLmodel artifact. Pickle deserialization is a process of converting a byte stream back into a Python object, which can be exploited to run malicious commands if the input is untrusted.

Recommendations Update MLflow to a version later than 3.14.0. As a temporary mitigation, restrict the loading of untrusted MLmodel artifacts until the software is updated.