Database/AI/ML frameworks & serving
MLflow: loading a SHAP explainer model deserializes untrusted data and runs arbitrary code
Impact
MLflow's SHAP explainer loader deserializes the stored explainer without validating it, so a crafted explainer model executes code as the current user. The practical exposure on a GPU fleet is the same model-supply-chain path as other MLflow deserialization bugs: an explainer pulled from a shared registry runs in the context of a notebook, evaluation job or serving process. ZDI tracks this separately from the pickle evaluation-artifact issue (CVE-2026-118623) - a different code path and a different ZDI case - so it is listed separately here. User interaction is required.
Who can reach it
A user or job must load an attacker-supplied SHAP explainer model through MLflow. No authentication needed to produce the model.
What to do
Upgrade MLflow when a fixed release is identified - the advisory in the record does not name one. Meanwhile only load explainers from registries you control and keep that work off nodes holding cluster credentials. Picking up a fix requires restarting the processes that load models.
References
Related entries
- TorchServe: predictable /tmp extraction path lets a local user swap a model handler and run code as the service accountCVE-2026-123974 · PyTorch TorchServe (model archive extraction directory in /tmp)High
- Keras (`TorchModuleWrapper`): Unsafe deserialization of attacker-controlled PyTorch pickle inside a Keras modelCVE-2026-12484 · Keras (`TorchModuleWrapper`)High
- timm: untrusted checkpoint deserialization executes arbitrary code in the loading processCVE-2026-15679 · Hugging Face pytorch-image-models (timm) checkpoint loadingHigh
- HuggingFace transformers (`Trainer._load_rng_state`): Arbitrary code execution when a training run resumesCVE-2026-1839 · HuggingFace transformers (`Trainer._load_rng_state`)High
- NVIDIA NeMo Speech: malicious input data leads to remote code executionCVE-2026-24239 · NVIDIA NeMo SpeechHigh
- NVIDIA NeMo Speech: RCE and privilege escalation in the speech data explorerCVE-2026-24267 · NVIDIA NeMo Speech (speech data explorer)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.