MLflow statsmodels + dspy pickle bypass (CVE-2026-96804 / CVE-2026-96775, CVSS 8.8): MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False can be skipped
CERT/CC VU#369093 (revised 23 September 2026) and NVD document two MLflow flavor flaws that let crafted MLmodel artifacts reach pickle deserialization even when MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False. CVE-2026-96804: statsmodels flavor omits the control in _load_model() (NVD: versions 2.1.0–3.14.0; CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:N). CVE-2026-96775: dspy flavor applies the control only when model_path ends in .pkl, so a non-.pkl path bypasses it (NVD: dspy >=2.0; CVSS 3.1 8.8 AV:N/AC:L/PR:N/UI:R). Attack path needs write/supply influence over models a victim loads. CERT: statsmodels patched in MLflow >=3.15.0; MLflow not coordinated for a full statement — until a further dspy fix, avoid loading models via the dspy flavor if pickle must stay blocked. Reporter: Prasanna Dabi. Primary: CERT VU#369093; NVD records.
- Product
- MLflow (statsmodels + dspy model flavors / pyfunc load_model)
- Versions
- statsmodels: 2.1.0–3.14.0 (fix >=3.15.0 per CERT); dspy: >=2.0 — avoid dspy loads until further fix if pickle must stay blocked
- CVSS
- (CVSS 3.1, NVD for both CVEs)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Exploited in Australia?
- unknown
- Patch to
- Upgrade MLflow to >=3.15.0 (statsmodels path); do not load untrusted MLmodel artifacts; until dspy is fixed, avoid dspy flavor loads when pickle deserialization must remain disabled; restrict who can write model registries
Primary: CERT/CC VU#369093 — MLflow dspy/statsmodels pickle control bypass (rev 23 Sep 2026) · Vendor: NVD — CVE-2026-96804 (statsmodels flavor) · CVE: CVE-2026-96804, CVE-2026-96775 · NVD — CVE-2026-96775 (dspy flavor)