MLflow is an open-source platform for managing machine learning lifecycles, including model packaging and deployment. It supports multiple 'flavors' for storing and loading models. To mitigate risks from unsafe pickle deserialization, MLflow implemented the MLFLOW_ALLOW_PICKLE_DESERIALIZATION safety control to block pickle deserialization when disabled by the user. However, the dspy flavor only enforces this control if the model path ends with '.pkl'; if the file extension differs, the control is bypassed, allowing pickle deserialization regardless of the safety setting. The statsmodels flavor does not enforce this control at all, permitting pickle deserialization unconditionally. Exploiting these flaws allows arbitrary remote code execution through malicious pickle payloads embedded in model files. The vulnerability requires an attacker to have write access to the location from which MLflow models are loaded. The issue was confirmed in MLflow version 3.12.0. The statsmodels flavor vulnerability has been fixed in MLflow versions 3.15.0 and later. No coordinated vendor fix is currently available for the dspy flavor vulnerability.

An attacker with write access to MLflow model storage can craft malicious pickle payloads that execute arbitrary code when loaded via the vulnerable dspy or statsmodels flavors. This bypasses user-configured safety controls intended to block pickle deserialization, resulting in remote code execution. This poses a significant security risk for environments using these flavors to load untrusted or tampered models.

Users should upgrade MLflow to version 3.15.0 or later to obtain the patch for the statsmodels flavor vulnerability. Until a fix is released for the dspy flavor, users who wish to block pickle deserialization should avoid loading models using the dspy flavor. Monitor vendor advisories for updates regarding a fix for the dspy flavor. No other mitigation or workaround is currently documented.