Remote Code Execution Vulnerability in MLflow dspy Flavor by Databricks
CVE-2026-96775

8.8HIGH

Key Information:

Vendor

Mlflow

Status
Mlflow
Vendor
CVE Published:
23 September 2026

What is CVE-2026-96775?

Databricks MLflow's dspy flavor, starting from version 2.0, presents a vulnerability due to improper application of the MLFLOW_ALLOW_PICKLE_DESERIALIZATION security control. This control is enforced only when the model_path ends with .pkl. Consequently, this oversight can be exploited by remote attackers to execute arbitrary code through crafted MLmodel artifacts, posing significant risks to the integrity and confidentiality of affected systems.

Affected Version(s)

MLflow 2.0

References

https://kb.cert.org/vuls/id/369093

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.