CVE-2026-118623: MLflow: pickle deserialization enables RCE

AWAITING NVD

Published November 3, 2026

CISO Take

MLflow's PickleEvaluationArtifact parser deserializes untrusted pickle data (CWE-502), so a crafted file or page can run attacker code inside the MLflow process once a user opens or visits it. MLflow is the experiment-tracking and model-registry backbone for many ML teams, with 695 downstream dependents, a Package Risk Score of 81/100, 95 other CVEs and an OpenSSF Scorecard of only 5.4/10, so a compromised host is likely to hold model artifacts, registry access and cloud credentials. No public exploit, Nuclei template, KEV listing, EPSS score or CVSS rating exists yet, so likelihood is unquantified, but pickle deserialization bugs are usually easy to weaponize once details leak. The advisory (ZDI-26-839) does not list a patched version, so check the MLflow release notes and ZDI advisory for a fix and upgrade as soon as one is available. Until then, do not open evaluation artifacts from untrusted sources and run MLflow under least-privilege service accounts.

Sources:NVDZDIOpenSSFATLAS

What is the risk?

Provisionally high. CWE-502 pickle deserialization gives arbitrary code execution in the MLflow process. User interaction is required (opening a malicious file or visiting a malicious page), which lowers mass-exploitation odds but suits targeted attacks on data scientists and ML engineers. No CVSS, EPSS, KEV or public exploit data is available (Sources: ZDI advisory, NVD description; confidence MEDIUM). Impact depends on the privileges of the MLflow process and on whether the tracking server is shared. Treat the rating as provisional until scoring and fix details are published.

How does the attack unfold?

Initial Access

Attacker delivers a malicious pickle file or lure page to an MLflow user.

AML.T0011.000

Exploitation

Opening or parsing the artifact deserializes untrusted pickle data and runs attacker code in the MLflow process.

AML.T0018.002

Credential Access

Payload harvests cloud, registry and artifact store credentials available to MLflow.

Impact

Attacker tampers with registered models or exfiltrates proprietary models and data.

AML.T0010.003

Initial Access

Attacker delivers a malicious pickle file or lure page to an MLflow user.

AML.T0011.000

Exploitation

Opening or parsing the artifact deserializes untrusted pickle data and runs attacker code in the MLflow process.

AML.T0018.002

Credential Access

Payload harvests cloud, registry and artifact store credentials available to MLflow.

Impact

Attacker tampers with registered models or exfiltrates proprietary models and data.

AML.T0010.003

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 2d ago36% patched~68d to patchFull package profile →

Do you use MLflow? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Check the MLflow release notes and ZDI-26-839 for a patched version and upgrade as soon as one is available; the affected and fixed ranges are not yet published. 2) Do not open or load evaluation artifacts or pickle files from untrusted or unverified sources. 3) Run MLflow with least-privilege service accounts, scoped cloud credentials and network segmentation from production serving. 4) Restrict who can upload or write artifacts to the tracking server and artifact store. 5) Scan pickle artifacts with picklescan or fickling and prefer safer formats such as safetensors or JSON. 6) Monitor MLflow hosts for unexpected child processes, outbound connections and credential access, and watch for newly logged artifacts from unknown users.

How is it classified?

Code ExecutionSupply ChainFrameworkModelTraining DataAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0011.003- Malicious Link AML.T0018.002- Embed Malware

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality and security of AI system resources

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and third-party AI component risks

OWASP LLM Top 10

LLM05-Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-118623?

Is CVE-2026-118623 actively exploited?

No confirmed active exploitation of CVE-2026-118623 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118623?

1) Check the MLflow release notes and ZDI-26-839 for a patched version and upgrade as soon as one is available; the affected and fixed ranges are not yet published. 2) Do not open or load evaluation artifacts or pickle files from untrusted or unverified sources. 3) Run MLflow with least-privilege service accounts, scoped cloud credentials and network segmentation from production serving. 4) Restrict who can upload or write artifacts to the tracking server and artifact store. 5) Scan pickle artifacts with picklescan or fickling and prefer safer formats such as safetensors or JSON. 6) Monitor MLflow hosts for unexpected child processes, outbound connections and credential access, and watch for newly logged artifacts from unknown users.

What systems are affected by CVE-2026-118623?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model registry and experiment tracking, model evaluation pipelines, MLOps platforms.

What is the CVSS score for CVE-2026-118623?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel registry and experiment trackingmodel evaluation pipelinesMLOps platforms

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0011.003Malicious Link

AML.T0018.002Embed Malware

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pickle files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29513.

Exploitation Scenario

An attacker plants a malicious pickle as an evaluation artifact, for example in a shared experiment, a public repository or a project shared with a data scientist, or hosts a malicious page that triggers its parsing. When an ML engineer opens it in an MLflow workflow or UI, the payload runs in the MLflow process and steals cloud credentials and registry tokens. The attacker then swaps a production model version for a backdoored one or exfiltrates proprietary models and datasets.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.