AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-gqvg-gmmx-x4hm: MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

highvulnerability

security

Source: GitHub Advisory DatabaseSeptember 1, 2026

Summary

MLflow's statsmodels flavor has a security control bypass that allows remote code execution (RCE, where an attacker can run commands on a system they don't own) even when pickle deserialization is disabled. The statsmodels flavor loads model files using pickle (a Python method for serializing objects) without checking the `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` security control, so an attacker can upload a malicious model artifact and execute arbitrary code when someone loads it with `mlflow.pyfunc.load_model()`.

Solution / Mitigation

Add a guard check to `mlflow/statsmodels/__init__.py` in the `_load_model` function that mirrors the pattern used in other flavors like sklearn. The fix imports `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` and related Databricks utilities, then raises an `MlflowException` if pickle deserialization is disabled and the code is not running in a Databricks environment, with an error message explaining that the statsmodels model requires pickle and directing users to set `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` to `'true'` to allow it.