fickling: MLAllowlist pass never runs, so malicious pickles pass check_safety as LIKELY_SAFE

Impact

fickling's UnsafeImportsML pass registers every import it inspects in a shared reported-code set, which makes the later MLAllowlist pass skip its check entirely. The allowlist was the layer that caught imports outside the known-safe ML ecosystem; with it dead, any standard-library module absent from the denylist rides through and check_safety() still answers LIKELY_SAFE. Because fickling.load() uses that verdict as the gate before pickle.loads(), a pipeline that scans uploaded models with fickling will deserialize and execute the payload while reporting the file as safe. Operators who put fickling in front of tenant- or hub-supplied checkpoints should treat every verdict issued by an affected version as unreliable, not just future ones.

Who can reach it

Anyone who can submit a model file into a pipeline that relies on fickling's verdict - a model registry upload, a Hugging Face artifact pulled by a job, a tenant-supplied checkpoint. No authentication to fickling itself; the code runs wherever the deserialization happens, typically a GPU worker.

What to do

Upgrade fickling to 0.1.12 and restart or rebuild anything that imports it (scanners, admission hooks, loader services, CI images). Re-scan artifacts that were cleared by versions up to and including 0.1.11, since the earlier LIKELY_SAFE results prove nothing. No infrastructure maintenance window needed - this is a Python dependency bump plus a re-scan of your model inventory.

References

Related entries

• SGLang (`/load_lora_adapter_from_tensors`): Unauthenticated RCE bypassing `SafeUnpickler`'s incomplete denylistCVE-2026-15969 · SGLang (`/load_lora_adapter_from_tensors`)Critical
• vLLM (image error echo): Error path returns sensitive content on invalid image inputCVE-2026-22778 · vLLM (image error echo)Critical
• Milvus (port 9091): Management port 9091 exposed by default enabling compromiseCVE-2026-26190 · Milvus (port 9091)Critical
• SGLang (multimodal ZMQ broker): Unauthenticated RCE via `pickle.loads()` on the ZMQ brokerCVE-2026-3059 · SGLang (multimodal ZMQ broker)Critical
• SGLang (encoder parallel disaggregation): Unauthenticated RCE via `pickle.loads()` in the disaggregation moduleCVE-2026-3060 · SGLang (encoder parallel disaggregation)Critical
• LiteLLM (MCP server creation): RCE via MCP server registrationCVE-2026-30623 · LiteLLM (MCP server creation)Critical