A critical deserialization vulnerability in MLflow allows authenticated remote attackers to execute arbitrary code via crafted MLmodel artifacts.

This vulnerability occurs because the statsmodel flavor fails to implement the MLFLOW_ALLOW_PICKLE_DESERIALIZATION security control within the _load_model function. An attacker with low privileges can leverage this flaw to perform arbitrary code execution by submitting a maliciously crafted MLmodel artifact.

The ability for an attacker to execute arbitrary code on the underlying host presents a severe risk to the confidentiality, integrity, and availability of the MLflow environment. Given the high CVSS score of 8.8, this flaw could lead to full system compromise, unauthorized data exfiltration, or the deployment of persistent threats within the data science infrastructure. Organizations relying on MLflow for model management face significant operational and reputational risks if these systems are exploited.

Immediate Action: Upgrade the MLflow installation to version 3.15.0 or later immediately to incorporate the missing security control.

Proactive Monitoring: Review application logs for suspicious model loading activity or unexpected process execution spawned by the MLflow service.

Compensating Controls: Implement strict network segmentation to limit access to the MLflow instance to trusted users only and ensure that artifact storage locations are subject to rigorous access controls and integrity checks.

Public Exploit Available: Unknown

The vulnerability in MLflow represents a significant security risk that necessitates prompt attention. Security teams must prioritize patching to version 3.15.0 across all environments to eliminate the deserialization flaw. Until updates are applied, restrict access to the MLflow interface to prevent unauthorized users from submitting malicious artifacts, as the current configuration lacks the necessary safeguards to prevent code execution.