CVE-2026-96804: High severity MLflow MLflow statsmodel flavor vulnerability
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False to enable the pickle deserialization security control.
MLflow statsmodel flavor MLFLOW_ALLOW_PICKLE_DESERIALIZATION = False
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using MLflow's statsmodel flavor in versions 2.1.0 through 3.14.0 are affected when they load an MLmodel artifact through the flavor's _load_model() path.
What does an attacker need to exploit the vulnerability?
An attacker needs to provide or cause a target to load a crafted MLmodel artifact. Loading that artifact can result in arbitrary code execution.
Does setting MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False protect the statsmodel flavor?
No. The affected statsmodel flavor omits this security control entirely in _load_model(), so the setting is not applied on that loading path.