CVE-2026-96775 Overview
CVE-2026-96775 is an insecure deserialization vulnerability [CWE-502] in MLflow's dspy flavor, affecting versions >= 2.0. The MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control is enforced only when the model_path ends with .pkl. A remote attacker can bypass this check by crafting an MLmodel artifact that references a serialized payload with a different file extension. Loading the artifact triggers pickle deserialization and executes attacker-controlled code within the MLflow host process.
Critical Impact
Remote attackers can achieve arbitrary code execution on systems that load a malicious MLflow dspy model artifact, compromising the confidentiality, integrity, and availability of the MLflow environment.
Affected Products
- MLflow dspy flavor, versions >= 2.0
- Environments loading untrusted MLflow model artifacts
- ML pipelines and model registries integrating the affected dspy flavor
Discovery Timeline
- 2026-09-23 - CVE-2026-96775 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-96775
Vulnerability Analysis
MLflow serializes and loads models through per-framework flavors. The dspy flavor implements a guardrail that honors the MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable to block untrusted pickle loads. The check is scoped incorrectly: it fires only when the model_path string ends in .pkl.
An attacker who supplies an MLmodel artifact can point model_path to any other extension. The guardrail returns without blocking, and MLflow proceeds to deserialize the referenced file with Python's pickle module. Deserialization of attacker-controlled pickle data executes arbitrary Python code in the loader's process.
Exploitation requires user interaction to load the crafted artifact, but no authentication or privileges on the target system. Successful exploitation yields code execution with the privileges of the MLflow process, which typically has access to model registries, credentials, and connected data stores.
Root Cause
The root cause is an extension-based allowlist check rather than a content or format check. Trusting the .pkl suffix as an indicator of pickle content lets an attacker rename or reference the payload with any other extension to bypass the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False control. The underlying weakness is deserialization of untrusted data [CWE-502].
Attack Vector
The attacker publishes a malicious MLflow model to a registry, shared storage, or repository that a victim later loads with the dspy flavor. The MLmodel manifest references a pickle payload with a non-.pkl extension. When the victim loads the model, MLflow deserializes the payload and executes the embedded code.
See the CERT Vulnerability Note #369093 for additional technical detail.
Detection Methods for CVE-2026-96775
Indicators of Compromise
- MLmodel artifacts whose model_path references files with extensions other than .pkl but contain pickle byte signatures such as \\x80\\x04 or \\x80\\x05.
- Unexpected child processes spawned by MLflow tracking servers, workers, or notebook kernels after a model load event.
- Outbound network connections initiated from MLflow processes to unfamiliar hosts immediately following artifact retrieval.
Detection Strategies
- Inspect MLflow artifact stores for MLmodel files that combine the dspy flavor with non-.pklmodel_path values.
- Scan pickle payloads inside model artifacts for dangerous opcodes such as GLOBAL, REDUCE, and INST that indicate callable execution.
- Correlate model-load events with process, file, and network telemetry from the host running MLflow to surface deviations from baseline behavior.
Monitoring Recommendations
- Enable process ancestry and command-line logging on MLflow servers and ML workstations to catch interpreter-spawned shells.
- Alert on writes to ~/.ssh, cron paths, and credential files by Python processes loading MLflow models.
- Forward MLflow application logs and host telemetry to a central analytics platform for retrospective hunting on model-load activity.
How to Mitigate CVE-2026-96775
Immediate Actions Required
- Upgrade the MLflow dspy flavor to a fixed release once published by the maintainers, tracked through the CERT Vulnerability Note #369093.
- Block loading of MLflow models from untrusted sources, including public model hubs and unverified registries.
- Audit existing artifact stores for dspy-flavored models introduced since the affected versions were deployed.
Patch Information
At the time of NVD publication on 2026-09-23, no vendor advisory URL is listed in the CVE record. Monitor the CERT Vulnerability Note #369093 and the MLflow project release notes for the fixed version and apply it across all environments that load dspy models.
Workarounds
- Restrict MLflow model loading to artifacts produced and signed by trusted internal pipelines only.
- Run MLflow tracking servers and model-loading workers as unprivileged users inside isolated containers with egress filtering.
- Enforce artifact review before promotion, validating that pickle payloads are not referenced by non-.pklmodel_path entries.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.