---
id: "CVE-2026-118623"
kind: "vulnerability"
aliases: ["CVE-2026-118623"]
title: "MLflow: crafted pickle evaluation artifact lets remote attacker run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "mlflow", "fixed": ["3.13.0"], "affected": "< 3.13.0 (lower bound not stated)", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-tooling", "ml-platform", "mlflow", "python"]
not_affected_if: ["no-untrusted-artifacts"]
published_at: "2026-11-04T00:17:23+00:00"
first_seen_at: "2026-11-04T00:46:16+00:00"
updated_at: "2026-11-04T00:48:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118623", "first_seen_at": "2026-11-04T00:46:16+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:48:28+00:00"}]
---

# MLflow: crafted pickle evaluation artifact lets remote attacker run code

MLflow deserializes pickle files from user-supplied input without validating them, so a crafted file can run code in the MLflow process. An attacker gets code execution as the account running MLflow once a user visits a malicious page or opens a malicious file.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:mlflow affected < 3.13.0 (lower bound not stated) fixed 3.13.0

## How to check

Run 'pip show mlflow' (or 'pip show mlflow-skinny'); versions below 3.13.0 are treated as exposed, since the first affected version is not stated. Also check whether any evaluation runs load pickle evaluation artifacts from sources you do not control.

## Fix

Upgrade MLflow to 3.13.0 (per ZDI-26-839). The fix makes PickleEvaluationArtifact loading raise unless MLFLOW_ALLOW_PICKLE_DESERIALIZATION is true (PR 23183). Do not set that variable to true on systems that handle untrusted artifacts.

## Timeline

- 2026-11-04T00:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118623
- 2026-11-04T00:48:28+00:00 analyst — ZDI-26-839 says fixed in MLflow 3.13.0 (PR 23183, merged 2026-05-11, labelled v3.12.1 so a 3.12.1 backport is possible but unconfirmed). Lower bound of affected versions not stated anywhere I read. No exploitation or PoC found.

## Documents

- [advisory] ZDI-26-839 MLflow PickleEvaluationArtifact https://www.zerodayinitiative.com/advisories/ZDI-26-839/
- [fix] mlflow PR 23183: guard PickleEvaluationArtifact https://github.com/mlflow/mlflow/pull/23183

## From the sources

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of pickle files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29513.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_