Remote Code Execution in MLflow PickleEvaluationArtifact (CVE‑2026‑118623) Threatens Model Pipelines
What It Is — A remote‑code‑execution (RCE) flaw was discovered in the PickleEvaluationArtifact component of the open‑source MLflow platform (CVE‑2026‑118623). The vulnerability stems from the deserialization of untrusted pickle files without proper validation. An attacker who can convince a user to open a malicious pickle file—or load a crafted page that triggers the deserialization—can execute arbitrary code in the context of the MLflow process. The issue carries a CVSS 7.8 (High) score (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is fixed in MLflow 3.13.0.
Affected Products — MLflow versions prior to 3.13.0 (all editions).
Why It Matters for Trust & Control Assurance — The flaw highlights the need for robust input‑validation and secure deserialization controls—an objective that maps to multiple compliance frameworks. Verisq’s Control Mapping capability helps you evidence that this control is in place and continuously monitored.
Recommended Actions —
- Upgrade all MLflow deployments to 3.13.0 or later.
- Conduct a code‑review of any custom pickle handling to enforce strict validation or replace pickle with safer serialization formats.
- Enable runtime monitoring for unexpected process behavior (e.g., anomalous system calls).
- Document the remediation and map the input‑validation control to your framework of record.