{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mlflow--2.1.0--3.15.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2024-37052"},{"cvss":8.8,"id":"CVE-2024-37060"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mlflow (\u003e= 2.1.0, \u003c 3.15.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["LF Projects"],"content_html":"\u003cp\u003eMLflow contains a security vulnerability where the \u003ccode\u003emlflow.statsmodels\u003c/code\u003e flavor bypasses the \u003ccode\u003eMLFLOW_ALLOW_PICKLE_DESERIALIZATION\u003c/code\u003e security control. This control was originally introduced to prevent unsafe \u003ccode\u003epickle.load\u003c/code\u003e execution during model loading, specifically to mitigate risks associated with CVE-2024-37052 through CVE-2024-37060. When operators set this variable to \u003ccode\u003eFalse\u003c/code\u003e, they intend to block all pickle-based deserialization. However, the \u003ccode\u003emlflow.statsmodels\u003c/code\u003e implementation completely omits this security guard. An attacker who can upload or place a crafted MLmodel artifact into an accessible artifact store can trigger arbitrary code execution on any system or process that invokes \u003ccode\u003emlflow.pyfunc.load_model()\u003c/code\u003e against the malicious model, regardless of the environment configuration. This vulnerability effectively nullifies a primary defense-in-depth measure against remote code execution in MLflow deployments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an accessible MLflow artifact store or model registry without authentication (default deployments).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious \u003ccode\u003emodel.pkl\u003c/code\u003e payload that triggers command execution upon deserialization.\u003c/li\u003e\n\u003cli\u003eAttacker creates a corresponding \u003ccode\u003eMLmodel\u003c/code\u003e YAML file specifying \u003ccode\u003emlflow.statsmodels\u003c/code\u003e as the loader module.\u003c/li\u003e\n\u003cli\u003eAttacker uploads the malicious \u003ccode\u003emodel.pkl\u003c/code\u003e and \u003ccode\u003eMLmodel\u003c/code\u003e files to the target artifact store.\u003c/li\u003e\n\u003cli\u003eAttacker influences a target application or ML pipeline to call \u003ccode\u003emlflow.pyfunc.load_model()\u003c/code\u003e with the path to the malicious model.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emlflow.pyfunc.load_model()\u003c/code\u003e function dispatches the load request to \u003ccode\u003emlflow.statsmodels._load_pyfunc()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003emlflow.statsmodels\u003c/code\u003e executes \u003ccode\u003esmio.load_pickle()\u003c/code\u003e without checking the \u003ccode\u003eMLFLOW_ALLOW_PICKLE_DESERIALIZATION\u003c/code\u003e environment variable.\u003c/li\u003e\n\u003cli\u003eThe malicious pickle payload deserializes, resulting in arbitrary code execution with the privileges of the calling process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary code with the permissions of the MLflow service or the application loading the model. This can lead to full system compromise, exfiltration of sensitive model data, or persistence within the environment. Targeted sectors include organizations leveraging MLflow for MLOps, particularly those with internet-exposed model registries lacking authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade MLflow to version 3.15.0 or later immediately to include the guard logic.\u003c/li\u003e\n\u003cli\u003eImplement strict authentication for all MLflow artifact stores and model registries to prevent unauthorized model uploads.\u003c/li\u003e\n\u003cli\u003eAudit all artifact stores for suspicious or unknown \u003ccode\u003eMLmodel\u003c/code\u003e files referencing the \u003ccode\u003emlflow.statsmodels\u003c/code\u003e flavor.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, implement strict file-system access controls (ACLs) on model storage locations to ensure only trusted service identities can modify model artifacts.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-01T18:00:04Z","date_published":"2026-09-01T18:00:04Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mlflow-statsmodels-bypass/","summary":"The MLflow 'statsmodels' flavor fails to implement the 'MLFLOW_ALLOW_PICKLE_DESERIALIZATION' security control, allowing unauthenticated attackers to achieve arbitrary code execution via crafted pickle model artifacts.","title":"MLflow Statsmodels Flavor Security Control Bypass","url":"https://feed.craftedsignal.io/briefs/2026-09-mlflow-statsmodels-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Mlflow (\u003e= 2.1.0, \u003c 3.15.0)","version":"https://jsonfeed.org/version/1.1"}