Database/AI/ML frameworks & serving
MLflow: pickle evaluation artifact deserialization runs arbitrary code when a model is loaded
Impact
Loading an MLflow evaluation artifact backed by a pickle file executes code contained in the file in the context of the loading process. On a shared GPU fleet this is the classic model-supply-chain path: anyone who can get a crafted artifact into the registry or onto a path a user loads gets code execution as whoever runs the load - typically a training job, a notebook kernel or an inference worker with fleet credentials. The record requires user interaction (the target must open the malicious file), so this is not remotely triggerable on its own.
Who can reach it
A user or job with access to MLflow must load an attacker-supplied pickle-backed evaluation artifact. No authentication is needed to craft the file; the interaction is on the victim side.
What to do
Upgrade MLflow once a fixed release is identified - the ZDI advisory in the record does not name a fixed version. Until then treat artifacts from the registry as untrusted code and load them only in jobs that do not hold cluster credentials. Picking up a fix means restarting MLflow clients and any worker that loads artifacts.
References
Related entries
- MLflow: loading a SHAP explainer model deserializes untrusted data and runs arbitrary codeCVE-2026-118627 · MLflow SHAP explainer loading (load_explainer)High
- TorchServe: predictable /tmp extraction path lets a local user swap a model handler and run code as the service accountCVE-2026-123974 · PyTorch TorchServe (model archive extraction directory in /tmp)High
- Keras (`TorchModuleWrapper`): Unsafe deserialization of attacker-controlled PyTorch pickle inside a Keras modelCVE-2026-12484 · Keras (`TorchModuleWrapper`)High
- timm: untrusted checkpoint deserialization executes arbitrary code in the loading processCVE-2026-15679 · Hugging Face pytorch-image-models (timm) checkpoint loadingHigh
- HuggingFace transformers (`Trainer._load_rng_state`): Arbitrary code execution when a training run resumesCVE-2026-1839 · HuggingFace transformers (`Trainer._load_rng_state`)High
- NVIDIA NeMo Speech: malicious input data leads to remote code executionCVE-2026-24239 · NVIDIA NeMo SpeechHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.