HighVulnerability
CVE-2026-96775: MLflow dspy flavor unsafe pickle deserialization via crafted MLmodel artifact
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-96775
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.6%
Summary
MLflow's dspy flavor, versions 2.0 and later, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False control only when model_path ends in .pkl. A remote attacker can use a crafted MLmodel artifact to execute arbitrary code.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
- MediumAI broke the cybersecurity world. What’s next?Similar attack · The Verge (AI)
- InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
- InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
- MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog