A critical deserialization vulnerability in MLflow allows unauthenticated remote attackers to execute arbitrary code via malicious model artifacts.

This vulnerability stems from a flaw in the dspy flavor where the MLFLOW_ALLOW_PICKLE_DESERIALIZATION security control is only enforced if the file path ends in .pkl. An unauthenticated attacker can bypass this control by providing a crafted artifact with a different file extension, leading to arbitrary code execution through insecure deserialization.

The ability for a remote, unauthenticated attacker to execute arbitrary code poses a severe threat to the confidentiality, integrity, and availability of the host system. Given the CVSS score of 8.8, this vulnerability could lead to full system compromise, data exfiltration, or the unauthorized modification of machine learning models. Organizations relying on MLflow for model deployment are at high risk of lateral movement and persistent compromise if this flaw is exploited.

Immediate Action: Monitor official vendor channels for the release of a security update that addresses the incomplete extension check and apply it immediately upon availability.

Proactive Monitoring: Review system and application logs for unusual file paths or unexpected deserialization errors associated with MLmodel artifact processing.

Compensating Controls: Restrict access to MLflow deployment endpoints to trusted networks and implement strict file validation controls to ensure that only authorized and verified model artifacts are processed by the dspy flavor.

Public Exploit Available: No

This vulnerability represents a significant security risk to MLflow implementations. Due to the high severity and the potential for remote code execution, administrators should prioritize the identification of all instances running MLflow 2.0 or later. Although no patch is currently identified, security teams must proactively monitor the vendor advisory for updates and be prepared to deploy fixes immediately to mitigate the risk of exploitation.