CVE-2026-96804: MLflow statsmodels flavor arbitrary code execution via pickle deserialization

CVE-2026-96804 · Severity: high · CVSS 8.8 · Published 2026-09-23

MLflow is a platform for managing machine learning models. The statsmodels model flavor fails to enforce a security control that blocks unsafe pickle deserialization, allowing attackers to execute arbitrary code by uploading a malicious model file. An attacker with write access to a model repository can exploit this to gain code execution on systems loading the compromised model.

Technologies: Mlflow. Vendors: MLflow.

Quick answers

Is CVE-2026-96804 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-96804 being exploited in the wild.
How severe is CVE-2026-96804?
High severity, with a CVSS score of 8.8, published 23 September 2026.
Which products and versions are affected?
Mlflow 2.1.0 to 3.14.0.
Is there a fix for CVE-2026-96804?
A patch was published on 2026-09-23: Patched in versions 3.15.0 and later for statsmodels flavor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96804 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-96804?
Check whether you run Mlflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The statsmodels flavor in MLflow's _load_model() function fails to check the MLFLOW_ALLOW_PICKLE_DESERIALIZATION flag before deserializing pickle files, allowing bypass of the intended security control. The vulnerability requires an attacker to have write access to the model storage location to craft a malicious MLmodel artifact. Exploitation results in arbitrary code execution in the context of the MLflow model loading process.

Affected products

  • MLflow MLflow 2.1.0 to 3.14.0

Timeline

  • 2026-09-16: disclosed
  • 2026-09-23: patched: Patched in versions 3.15.0 and later for statsmodels flavor

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.