---
id: "CVE-2026-118627"
kind: "vulnerability"
aliases: ["CVE-2026-118627"]
title: "MLflow: SHAP explainer loading lets a crafted file run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "mlflow", "fixed": ["3.17.0"], "affected": "< 3.17.0", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-tooling", "deserialization", "machine-learning", "mlflow", "python"]
not_affected_if: ["no-shap-explainer-loading", "trusted-model-files-only"]
published_at: "2026-11-04T00:17:23+00:00"
first_seen_at: "2026-11-04T00:46:16+00:00"
updated_at: "2026-11-04T00:48:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118627", "first_seen_at": "2026-11-04T00:46:16+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:48:28+00:00"}]
---

# MLflow: SHAP explainer loading lets a crafted file run code

MLflow's SHAP load_explainer function deserializes untrusted data without validating it, so a crafted model file can execute code. An attacker gets code execution as the user running MLflow once the target opens the malicious file or visits a malicious page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:mlflow affected < 3.17.0 fixed 3.17.0

## How to check

- Run `pip show mlflow` (also mlflow-skinny); versions below 3.17.0 are affected per ZDI. NVD lists 3.11.2.dev0 as an affected version.
- Search your code and pipelines for `mlflow.shap.load_explainer` or loading of SHAP-flavor models from registries or files you did not create.
- Check whether MLFLOW_ALLOW_PICKLE_DESERIALIZATION is set in those environments; after the fix, setting it to true re-enables unpickling.

## Fix

Upgrade to MLflow 3.17.0 or later (per ZDI-26-843). The code fix (PR 25566) makes mlflow.shap.load_explainer refuse to unpickle unless MLFLOW_ALLOW_PICKLE_DESERIALIZATION is enabled. Until upgraded, load SHAP explainers only from files you created.

## Timeline

- 2026-11-04T00:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118627
- 2026-11-04T00:48:28+00:00 analyst — ZDI-26-843 says fixed in 3.17.0 and links PR 25566 (merged 2026-09-03, adds pickle guard to mlflow.shap). Fix version comes from ZDI, not an MLflow release page, so nothing marked verified. NVD lists affected 3.11.2.dev0 only; lower bound unknown. No exploitation or PoC seen. Sibling MLflow CVEs (118623, 118628) are in parallel runs.

## Documents

- [advisory] ZDI-26-843 MLflow SHAP load_explainer https://www.zerodayinitiative.com/advisories/ZDI-26-843/
- [fix] mlflow PR 25566: Guard mlflow.shap explainer load with MLFLOW_ALLOW_PICKLE_DESERIALIZATION https://github.com/mlflow/mlflow/pull/25566

## From the sources

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the loading of SHAP explainer models. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30301.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_