CVE-2024-37060: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling
highvulnerability
security
Summary
CVE-2024-37060 is a vulnerability in MLflow (a machine learning platform) version 1.27.0 and newer where deserialization of untrusted data (the process of converting received data back into usable objects without checking if it's safe) can occur. A malicious Recipe (a workflow template in MLflow) could exploit this to execute arbitrary code (run any commands) on a user's computer when the Recipe is run.
Vulnerability Details
CVSS Score
8.8(high)
EPSS (30-day exploit probability)
EPSS: 0.4%
Classification
Attack Type
Model Poisoning
Attack SophisticationModerate
Impact (CIA+S)
integrityconfidentiality
Affected Vendors
Related Issues
Original source: https://nvd.nist.gov/vuln/detail/CVE-2024-37060
First tracked: February 15, 2026 at 08:46 PM
Classified by LLM (prompt v3) · confidence: 92%