{"id":"CVE-2026-118623","kind":"vulnerability","aliases":["CVE-2026-118623"],"related":[],"title":"MLflow: crafted pickle evaluation artifact lets remote attacker run code","description":"MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of pickle files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29513.","summary":"MLflow deserializes pickle files from user-supplied input without validating them, so a crafted file can run code in the MLflow process. An attacker gets code execution as the account running MLflow once a user visits a malicious page or opens a malicious file.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mlflow","fixed":["3.13.0"],"affected":"< 3.13.0 (lower bound not stated)","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","ml-platform","mlflow","python"],"not_affected_if":["no-untrusted-artifacts"],"how_to_check":"Run 'pip show mlflow' (or 'pip show mlflow-skinny'); versions below 3.13.0 are treated as exposed, since the first affected version is not stated. Also check whether any evaluation runs load pickle evaluation artifacts from sources you do not control.","fix":"Upgrade MLflow to 3.13.0 (per ZDI-26-839). The fix makes PickleEvaluationArtifact loading raise unless MLFLOW_ALLOW_PICKLE_DESERIALIZATION is true (PR 23183). Do not set that variable to true on systems that handle untrusted artifacts.","status":"open","published_at":"2026-11-04T00:17:23+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:47:51+00:00","updated_at":"2026-11-04T00:48:28+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-04T00:47:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"MLflow: crafted pickle evaluation artifact lets remote attacker run code","impact":"high","summary":"MLflow deserializes pickle files from user-supplied input without validating them, so a crafted file can run code in the MLflow process. An attacker gets code execution as the account running MLflow once a user visits a malicious page or opens a malicious file.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mlflow","python","ml-platform"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Code runs in the MLflow process as its user.","analyst_note":"Find affected MLflow version ranges and the fixed version from the NVD entry or the ZDI advisory (ZDI-CAN-29513).","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-artifacts"],"who_is_affected":"Teams running MLflow where users load or evaluate pickle artifacts from untrusted sources are the likely exposure; the sources do not list affected version ranges. unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000644,"input_tokens":4239,"output_tokens":441,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected MLflow version ranges and the fixed version from the NVD entry or the ZDI advisory (ZDI-CAN-29513).","search":"'-118623':13A,16A '-2026':12A,15A '29513':169C 'account':56B 'affect':91C 'ai':19B 'ai-tool':18B 'allow':83C 'arbitrari':88C 'artifact':5A 'attack':8A,50B,85C,150C 'code':10A,44B,52B,78C,89C,157C 'context':160C 'craft':2A,40B 'current':163C 'cve':11A,14A 'data':76C,140C,148C 'deseri':27B,73C,145C 'evalu':4A 'execut':53B,79C,87C,156C 'exist':120C 'exploit':100C 'file':29B,41B,70B,116C,126C 'flaw':119C 'get':51B 'input':34B 'instal':92C 'interact':96C 'issu':128C 'lack':132C 'let':6A 'leverag':152C 'malici':64B,69B,110C,115C 'ml':22B 'ml-platform':21B 'mlflow':1A,17A,24B,26B,47B,58B,71C,94C 'must':107C 'open':67B,113C 'page':65B,111C 'pars':123C 'pickl':3A,28B,125C 'pickleevaluationartifact':72C 'platform':23B 'process':48B,164C 'proper':134C 'python':25B 'remot':7A,77C,84C 'requir':98C 'result':129C,143C 'run':9A,43B,57B 'specif':118C 'suppli':33B,139C 'target':106C 'tool':20B 'untrust':75C,147C 'user':32B,61B,95C,138C 'user-suppli':31B,137C 'valid':36B,135C 'visit':62B,108C 'vulner':80C,82C,102C,154C 'within':121C 'without':35B 'zdi':167C 'zdi-can':166C","nicknames":[],"mitigations":[],"who_affected":"Teams running MLflow, mainly the Python package used for model evaluation, where a user loads a pickle evaluation artifact (PickleEvaluationArtifact) that someone else could have crafted. Code then runs as the account running MLflow. Teams that only load artifacts they produced themselves can skip it; the first affected version is not stated.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mlflow"],"ptokens":["mlflow"],"labels":["aitooling","high","mlflow","mlplatform","python"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118623","severity":null,"published_at":"2026-11-04T00:17:23+00:00","modified_at":"2026-11-04T00:17:23+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118623:1588","url":null,"severity":null,"published_at":"2026-11-04T00:48:28+00:00","modified_at":"2026-11-04T00:48:28+00:00","first_seen_at":"2026-11-04T00:48:28+00:00","fetched_at":"2026-11-04T00:48:28+00:00","note":"ZDI-26-839 says fixed in MLflow 3.13.0 (PR 23183, merged 2026-05-11, labelled v3.12.1 so a 3.12.1 backport is possible but unconfirmed). Lower bound of affected versions not stated anywhere I read. No exploitation or PoC found."}],"documents":[{"id":62147,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-839/","title":"ZDI-26-839 MLflow PickleEvaluationArtifact","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":62148,"url":"https://github.com/mlflow/mlflow/pull/23183","title":"mlflow PR 23183: guard PickleEvaluationArtifact","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}