Skip to content
Threat Feed
Subscribe

Product

Mlflow (>= 2.1.0, < 3.15.0)

1 brief RSS
high advisory

MLflow Statsmodels Flavor Security Control Bypass

The MLflow 'statsmodels' flavor fails to implement the 'MLFLOW_ALLOW_PICKLE_DESERIALIZATION' security control, allowing unauthenticated attackers to achieve arbitrary code execution via crafted pickle model artifacts.

mlflow
2t 2c