CVE-2026-96775: MLflow: dspy flavor pickle control bypass enables RCE

HIGH

Published September 23, 2026

CISO Take

MLflow's dspy model flavor only enforces the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safeguard when the model path ends in .pkl, so a crafted MLmodel artifact with a different extension can slip through and deserialize attacker-controlled pickle data, giving arbitrary code execution (CWE-502, CVSS 8.8). Exploitation needs a user or pipeline to load a malicious model, and the current risk signals are modest: EPSS is 0.00385 (roughly the 70th percentile), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC says TRACK. The real danger is the trust placed in the control: teams that set the pickle flag to False believe they are protected, yet model registries and shared artifact stores are common places for poisoned models to arrive. Check the CERT/CC advisory (VU#369093) for the fixed MLflow release and upgrade, avoid loading dspy-flavor models from untrusted sources, and audit registries for MLmodel artifacts whose dspy model files do not use a .pkl extension.

Sources:NVDEPSSATLASCERT/CC (kb.cert.org)

What is the risk?

High severity (CVSS 8.8, network vector, low complexity, no privileges, user interaction required). Near-term exploitation likelihood is low to moderate: EPSS 0.00385, not in KEV, no public exploit, SSVC TRACK. Impact if exploited is full compromise of confidentiality, integrity and availability on the host that loads the model. MLflow hosts often hold cloud credentials, experiment data and registry access, which raises the blast radius. Downstream dependent counts and package scorecard data are unavailable, so exposure cannot be quantified from the supplied data. Treat this as a priority patch for any environment that loads externally sourced dspy models.

How does the attack unfold?

Initial Access

Attacker publishes or uploads a crafted dspy-flavor MLmodel artifact to a shared registry or public source.

AML.T0010.003

User Execution

A user or pipeline loads the model, and the extension-only check skips the pickle deserialization guard.

AML.T0011.000

Code Execution

The embedded pickle payload deserializes and runs arbitrary code with the loader's privileges.

AML.T0018.002

Impact

Attacker steals credentials and model data, tampers with artifacts, and moves laterally into the ML environment.

AML.T0025

Initial Access

Attacker publishes or uploads a crafted dspy-flavor MLmodel artifact to a shared registry or public source.

AML.T0010.003

User Execution

A user or pipeline loads the model, and the extension-only check skips the pickle deserialization guard.

AML.T0011.000

Code Execution

The embedded pickle payload deserializes and runs arbitrary code with the loader's privileges.

AML.T0018.002

Impact

Attacker steals credentials and model data, tampers with artifacts, and moves laterally into the ML environment.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 6d ago15% patched~68d to patchFull package profile →

Do you use MLflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade MLflow to the fixed version listed in the CERT/CC advisory (https://kb.cert.org/vuls/id/369093) and the MLflow release notes. 2) Until patched, do not load dspy-flavor models from untrusted or unverified sources, and do not treat the pickle environment flag as sufficient protection. 3) Restrict write access to model registries and artifact stores, and require signing or hash verification for models promoted to production. 4) Run model loading in sandboxed, least-privilege containers with no ambient cloud credentials and restricted egress. 5) Detection: inventory MLmodel files with the dspy flavor, flag serialized model files whose extension is not .pkl, scan artifacts with pickle scanners (picklescan, fickling), and alert on unexpected child processes or outbound connections from MLflow loader and serving processes.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainModel PoisoningFrameworkModelAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0018.002- Embed Malware AML.T0058- Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Data quality and provenance for AI systems

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and AI system vulnerabilities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-96775?

Is CVE-2026-96775 actively exploited?

No confirmed active exploitation of CVE-2026-96775 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-96775?

1) Upgrade MLflow to the fixed version listed in the CERT/CC advisory (https://kb.cert.org/vuls/id/369093) and the MLflow release notes. 2) Until patched, do not load dspy-flavor models from untrusted or unverified sources, and do not treat the pickle environment flag as sufficient protection. 3) Restrict write access to model registries and artifact stores, and require signing or hash verification for models promoted to production. 4) Run model loading in sandboxed, least-privilege containers with no ambient cloud credentials and restricted egress. 5) Detection: inventory MLmodel files with the dspy flavor, flag serialized model files whose extension is not .pkl, scan artifacts with pickle scanners (picklescan, fickling), and alert on unexpected child processes or outbound connections from MLflow loader and serving processes.

What systems are affected by CVE-2026-96775?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, ML model registries, MLOps platforms, LLM application frameworks (DSPy).

What is the CVSS score for CVE-2026-96775?

CVE-2026-96775 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.65%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel servingML model registriesMLOps platformsLLM application frameworks (DSPy)

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0018.002Embed Malware

AML.T0058Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

Exploitation Scenario

An attacker uploads a crafted dspy-flavor model to a shared MLflow registry, or publishes it as a public artifact, with its serialized payload stored under a filename not ending in .pkl. A data scientist or automated deployment pipeline with MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False loads the model, expecting the guard to block unsafe deserialization. The guard is skipped because of the extension check, the pickle payload runs, and the attacker gets code execution on the host. From there they steal cloud and registry credentials, tamper with other models, exfiltrate training data, or move laterally into the production inference environment.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.