CVE-2026-96775: MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when

MLflow's dspy flavor (a component for machine learning model management) in versions 2.0 and later has a security flaw where it only checks the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False setting (a control that prevents loading untrusted serialized Python objects) when a model file ends in .pkl. An attacker can bypass this protection by using a different file extension in a crafted MLmodel artifact (a package containing model data), allowing them to run arbitrary code (malicious commands) on the system.