CVE-2026-118627

MLflow SHAP explainer loading bypasses pickle restrictions

MLflow · SHAP explainer model loading

First documented disclosure · Review checkpoint

Summary

Loading an attacker-supplied SHAP explainer can execute code as the user loading the model.

Severity and exploitation evidence

High · 7.8/10 · CVSS 3.0. Severity source.

Exploitation not established: The disclosure and project fix describe the weakness. The reviewed sources report no confirmed malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The SHAP flavor deserializes an explainer without applying the pickle setting enforced by other model loaders.

Conditions required

An attacker supplies an untrusted explainer and the victim or a process acting for them loads it.

Potential impact

Python code can run with the loader’s permissions on the machine that opens the model.

Affected versions and configurations

ZDI identifies MLflow 3.11.2.dev0 as affected. The CNA does not specify the full vulnerable range.

Fix and mitigation status

ZDI identifies 3.17.0 as fixed for this issue.

Practical next steps

Use a release containing the 3.17.0 fix and explicitly disable unsafe pickle deserialization. Load only trusted explainers, including in Databricks environments where the guard has exceptions.

Operating lesson

Trace the loading path for every supported model flavor before relying on a global pickle control.

Evidence and limits

The tagged 3.17.0 setting defaults to true, and the patch exempts detected Databricks Runtime and Databricks model serving. The evaluation-artifact bug has a different loader and CVE. The public project change predates the October 29 ZDI advisory and November 3 CNA record.

Sources