A flaw was found in MLflow. The statsmodel component of MLflow fails to enforce a security control that prevents insecure deserialization during model loading. This allows a remote attacker to execute arbitrary code by submitting a specially crafted MLmodel artifact. This vulnerability can lead to a complete compromise of the affected system.
Fix evidence last checked: 2026-10-19 11:46 UTC