VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control
Source CERT/CC
Fixed in 3.15.0 : patch affected systems as a priority.
Data as of 16 Sep 2026, 17:14 UTC
Rated Critical by Threat Radar from the CERT/CC text
- Patch
- Available – fixed in 3.15.0
What to do
AI-suggested
Users should upgrade MLflow to version 3.15.0 or later to obtain the patch for the statsmodels flavor vulnerability. Until a fix is released for the dspy flavor, users who wish to block pickle deserialization should avoid loading models using the dspy flavor. No other mitigation or workaround is currently documented.
Description
MLflow's dspy and statsmodels model flavors contain vulnerabilities that bypass the MLFLOW_ALLOW_PICKLE_DESERIALIZATION safety control designed to prevent unsafe pickle deserialization. The dspy flavor conditionally applies this control only if the model path ends with .pkl, allowing bypass if the file extension differs. The statsmodels flavor does not apply the control at all. This allows arbitrary remote code execution via malicious pickle payloads when loading models through these flavors. The vulnerability was confirmed in MLflow 3.12.0. The statsmodels flavor issue is patched in versions 3.15.0 and later. Users should upgrade and avoid using the dspy flavor until a fix is available.