CVE-2026-118623

MLflow evaluation artifacts bypass the pickle loading control

MLflow · PickleEvaluationArtifact

First documented disclosure · Review checkpoint

Summary

Opening a crafted evaluation artifact can execute Python as the user running the evaluation.

Severity and exploitation evidence

High · 7.8/10 · CVSS 3.0. Severity source.

Exploitation not established: The disclosure and project fix describe the weakness. The reviewed sources report no confirmed malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The artifact loader calls pickle.load on the supplied file without consulting MLflow’s pickle-deserialization setting.

Conditions required

An attacker can supply a pickle evaluation artifact and induce a user or evaluation pipeline to load it.

Potential impact

The payload inherits the evaluating process’s permissions, including access to files and services available to that process.

Affected versions and configurations

ZDI identifies MLflow 3.10.1 as affected. The CNA does not specify the full vulnerable range.

Fix and mitigation status

ZDI identifies 3.13.0 as fixed for this issue.

Practical next steps

Use a current release containing the 3.13.0 change and explicitly set MLFLOW_ALLOW_PICKLE_DESERIALIZATION=false. Restrict loading to artifacts with known provenance.

Operating lesson

Test whether artifact loaders actually enforce the configured serialization policy.

Evidence and limits

The 3.13.0 source defaults the setting to true. The patch lets operators enforce a prohibition, so upgrading alone does not disable unsafe pickle loading. The public project change predates the October 29 ZDI advisory and November 3 CNA record.

Sources