MLflow versions 2.1.0 through 3.14.x carry a high-severity security-control bypass that allows remote code execution through the mlflow.statsmodels flavor, even when the MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable is explicitly set to False1. The fix ships in MLflow 3.15.0.
The vulnerability, tracked as GHSA-gqvg-gmmx-x4hm, stems from an omission in the mlflow.statsmodels loading path. MLflow introduced MLFLOW_ALLOW_PICKLE_DESERIALIZATION as a safety control to block unsafe pickle.load execution during model loading, a measure adopted in response to CVE-2024-37052 through CVE-2024-37060. The reference implementation in mlflow/sklearn/__init__.py raises an MlflowException when the flag is set to False outside Databricks runtime and Databricks model serving. A prior fix (PR #21188) patched a similar bypass in the pyfunc flavor.
The mlflow.statsmodels flavor, however, never checks the flag. Its internal _load_model() function calls statsmodels.iolib.api.load_pickle(path) directly, a thin wrapper around Python's pickle.load. When mlflow.pyfunc.load_model() dispatches to the statsmodels flavor's _load_pyfunc implementation via importlib, the deserialization proceeds without any guard.
The practical attack path: an adversary who places a crafted MLmodel artifact into any accessible artifact store can trigger arbitrary code execution on any process that calls mlflow.pyfunc.load_model() against the malicious model. The advisory notes that default MLflow deployments without --app-name basic-auth have authentication disabled, meaning artifact upload requires no credentials.
ANALYSIS The combination of an unauthenticated artifact store and a silently bypassed safety control widens the attack surface considerably: operators who disabled pickle deserialization believed they had mitigated the entire class of pickle-based RCE, but the statsmodels path was never covered.
MLflow 3.15.0 is a security-dense release. Vector Wire previously reported that the same version patches a critical unauthenticated SSRF in the model-registry webhooks API (CVE-2026-64849) ctx, a high-severity auth bypass in CreateModelVersion (CVE-2026-69148) ctx, and a medium-severity auth bypass in the LogInputs endpoint (CVE-2026-69146) ctx.
ANALYSIS Four distinct security fixes landing in a single release makes 3.15.0 a mandatory upgrade for any team running MLflow in a networked environment. The statsmodels bypass is particularly consequential because it defeats an explicit operator-set control rather than exploiting a missing one.
Teams running affected versions (>= 2.1.0, < 3.15.0) should upgrade to MLflow 3.15.0.