Executive brief
MLflow is a machine learning platform that manages model artifacts and workflows. A malicious model artifact can execute arbitrary code when loaded by a user through MLflow's standard model-loading function, allowing an attacker who controls or modifies a shared model to compromise any system that loads it.
Technical details
This is a code-injection vulnerability (CWE-829) in MLflow's PyFunc model loader. When mlflow.pyfunc.load_model() processes a model artifact, it reads the MLmodel configuration file, extracts the python_function.loader_module and code paths, prepends the code directory to Python's sys.path, and then imports the specified loader module. An attacker who controls the model artifact can craft a malicious loader_module with arbitrary Python code at module level, which executes during the import statement before MLflow calls _load_pyfunc(). The attack requires network access to serve a malicious model or the ability to modify an existing shared model artifact; it may also require user interaction to trigger the load. Patches are likely available in newer MLflow versions.
Affected products
- MLflow MLflow 0.0.1 and newer
Timeline
- 2026-09-08: disclosed