MLflow Statsmodels Flavor Bypasses Pickle Deserialization Control, Enabling RCE

What's on the official record

The OSV advisory GHSA-gqvg-gmmx-x4hm reports a HIGH-severity vulnerability in the PyPI package mlflow, in the ml_platform layer, classified under CWE-502 (deserialization of untrusted data). MLflow introduced the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control to prevent unsafe pickle.load execution during model loading, in response to CVE-2024-37052 through CVE-2024-37060. When that control is set to False, operators expect all pickle deserialization to be blocked. The advisory reports that the mlflow.statsmodels flavor bypasses the control, enabling remote code execution via a crafted model artifact. The advisory names 3.15.0 as the fixed version and is dated 1 September 2026.

Assessment

For a platform or AI-stack owner, the record lets you check the deployed MLflow version against the fixed version 3.15.0 and confirm whether the mlflow.statsmodels flavor is reachable from untrusted model artifacts. The advisory states a HIGH-severity remote code execution path that the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False control does not block, which bears on whether to patch or pull the affected version before further model loading.

For a deal team, the record lets you scope diligence on any target whose product or service depends on MLflow model serving, by confirming the deployed version relative to 3.15.0 and whether statsmodels-flavored model loading is exposed to untrusted input. The advisory states a HIGH-severity remote code execution path, which bears on the condition of a target whose ML platform runs the affected package.

What would change this call

A revised advisory that names additional affected versions, a different fixed version, or a change in severity would change the remediation and diligence guidance above.

What to check next

Check	Why
MLflow version in deployed stacks	Anything below 3.15.0 is affected per the advisory
Whether the mlflow.statsmodels flavor is reachable from untrusted artifacts	The bypass is specific to that flavor
Whether MLFLOW_ALLOW_PICKLE_DESERIALIZATION is relied on as the sole control	The advisory reports the control is bypassed

Confidence

Filed 25 October 2026 from the record dated 1 September 2026.

Sources

[1] MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact — https://github.com/advisories/GHSA-gqvg-gmmx-x4hm

AI assistants read this note with get_note cyb-20260901-ghsa-gqvg-gmmx-x4hm. Connect yours