MLflow
CVE-2026-118623
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious pickle artifact to victim
-
DeliveryVictim opens file or visits page
-
ExploitMLflow parses untrusted pickle (PickleEvaluationArtifact)
-
ExecutionUnsafe deserialization triggers payload
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process an attacker-controlled pickle file through MLflow's PickleEvaluationArtifact parsing path - specifically, the target must visit a malicious page or open/load a malicious pickle artifact (UI:R, AV:L). This is NOT remotely triggerable against a running MLflow server; it depends on local processing of untrusted input. The limiting factors that reduce real-world risk are the mandatory user interaction (someone must open or load the crafted artifact) and the local attack vector. Code executes only in the context of the current user/process (S:U, no privilege escalation beyond that context). No special non-default MLflow configuration is cited in the available sources as a precondition; the trigger is the deserialization of a user-supplied pickle. |
| Impact | This is a genuine high-severity code-execution flaw (CVSS 3.0 base 7.8, CWE-502) but the CVSS vector materially tempers its real-world urgency: AV:L combined with UI:R means it is NOT remotely exploitable against a running server - despite the title calling it 'Remote Code Execution,' the vector requires the attacker to deliver a malicious pickle artifact that a victim then loads locally (visiting a malicious page or opening a malicious file). PR:N confirms no authentication is needed by the victim-side, and AC:L indicates reliable triggering once the file is processed. The vuln.today priority is 'this_week' (not act_now/emergency), which is consistent with a serious-but-interaction-gated issue. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided, so there is no signal of active or widespread exploitation at this time. Note the apparent tension between the 'Remote Code Execution' naming and the AV:L vector - the mechanism is local deserialization of an attacker-supplied pickle, not a network-reachable service flaw; defenders should treat this as a client/processing-side deserialization bug, not an internet-facing RCE. |
| Exploit ScenarioDerived | An attacker crafts a malicious pickle-based MLflow evaluation artifact and lures a victim (e.g., a data scientist or ML engineer) into loading it - by hosting it on a malicious page or sending it as a file. When MLflow parses the untrusted pickle, the embedded payload is deserialized and arbitrary code runs in the context of the user's MLflow process. No working public exploit was identified in the provided data, but the technique (CWE-502 pickle deserialization) is well understood and straightforward to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
Code execution in MLflow's PickleEvaluationArtifact handling occurs when a victim loads an attacker-controlled pickle file that is deserialized without proper validation (CWE-502). The CVSS 3.0 base score is 7.8, but the assessed vector is local (AV:L) with required user interaction (UI:R) and no scope change (S:U), so this is not remotely exploitable against a running MLflow server and code runs only in the victim process's context. No CISA KEV entry or public exploit was identified at time of analysis, and vuln.today prioritizes remediation as this_week.
RemediationAI
The provided sources do not list a fixed version or vendor patch advisory; consult ZDI-26-839 (https://www.zerodayinitiative.com/advisories/ZDI-26-839/) for current vendor guidance and any updated release. Until a fix is confirmed, prevent untrusted pickle artifacts from reaching PickleEvaluationArtifact: restrict users from loading evaluation artifacts or pickle files from untrusted sources, and avoid opening pages or files that supply such artifacts. Run MLflow artifact-processing workflows under a low-privilege account so that any deserialization executes only in the current user/process context, and isolate those workflows from sensitive data. These compensating controls align with the local, user-interaction-dependent vector but do not remove the underlying CWE-502 deserialization flaw.
Affected ProductsAI
MLflow installations that process evaluation artifacts through PickleEvaluationArtifact are affected. The provided data does not enumerate a specific version range or CPE string; the Zero Day Initiative advisory ZDI-26-839 is the reference point at https://www.zerodayinitiative.com/advisories/ZDI-26-839/. No other products are named in the supplied intelligence.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MLflow is an open-source platform for managing the machine-learning lifecycle, including experiments, models, and evaluation artifacts. PickleEvaluationArtifact is the parsing path for pickle-formatted evaluation artifacts; Python pickle deserialization can execute arbitrary code during unpickling, and the flaw is classified CWE-502 because user-supplied data is deserialized without sufficient validation. The assessed vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H shows that the attacker must get the victim to open or load a malicious pickle artifact or page, and the sources do not describe a remote server-side trigger or any non-default MLflow configuration precondition. The precise internal parsing behavior beyond pickle deserialization is not described in the available sources.
Know when Mlflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Requires a victim to open/load an attacker-supplied pickle (AV:L, UI:R); no victim authentication needed (PR:N); reliable deserialization yields full code execution in-process (C/I/A:H, S:U).
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of pickle files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29513.
Executive ViewAI
A high-severity vulnerability in MLflow, an open-source platform for managing the machine learning lifecycle, allows arbitrary code execution when a user loads a malicious pickle artifact. This impacts data scientists and ML engineers who use MLflow, potentially leading to compromised credentials, data breaches, or unauthorized access to model training environments. Leadership should prioritize remediation because MLflow is often used with sensitive data and production models, and exploitation could undermine trust in AI systems.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting pickle artifact loading to trusted sources, implementing file validation, using alternative serialization formats, and monitoring for anomalous file access.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking serv
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
GitHub PoC
Exploit-DB