# GHSA-gqvg-gmmx-x4hm: MLflow introduced `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` as a security control to prevent unsafe `pickle.load` execution during mo

> Attacker achieves remote code execution via crafted model artifact, bypassing MLflow's pickle deserialization safety control in the statsmodels flavor.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 1 Sep 2026

## What is GHSA-gqvg-gmmx-x4hm?

GHSA-gqvg-gmmx-x4hm is an unsafe deserialization vulnerability in mlflow, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

## Summary

MLflow introduced `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` as a security control to prevent unsafe `pickle.load` execution during model loading, in response to CVE-2024-37052 through CVE-2024-37060. When set to `False`, operators expect all pickle deserialization to be blocked. The most recent related fix (#21188) patched a bypass in the pyfunc flavor.

However, the `mlflow.statsmodels` flavor completely omits this guard. An attacker who places a crafted MLmodel artifact into any accessible artifact store can trigger arbitrary code execution on any process that calls `mlflow.pyfunc.load_model()` against the malicious model — **even when `MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False`**.

This is a security control bypass. The operator believes pickle RCE is mitigated; the statsmodels flavor silently ignores the control.

---

## Root Cause

`mlflow.pyfunc.load_model()` dispatches to flavor `_load_pyfunc` implementations via:

```
# mlflow/pyfunc/__init__.py L1170-1172
model_impl = importlib.import_module(conf[MAIN])._load_pyfunc(data_path)
```

The guarded pattern (from `mlflow/sklearn/__init__.py` L526-533, the reference implementation) is:

```
if (
    not MLFLOW_ALLOW_PICKLE_DESERIALIZATION.get()
    and not is_in_databricks_runtime()
    and not is_in_databricks_model_serving_environment()
):
    raise MlflowException("Deserializing model using pickle is disallowed...")
```

`mlflow/statsmodels/__init__.py` has **no such check**:

```
# L307-320 — no guard anywhere in this file
def _load_model(path):
    import statsmodels.iolib.api as smio
    return smio.load_pickle(path)   # calls pickle.load() directly

def _load_pyfunc(path):
    return _StatsmodelsModelWrapper(_load_model(path))
```

`statsmodels.iolib.api.load_pickle` is a thin wrapper around `pickle.load`. Its own docstring warns: *"Never unpickle data received from an untrusted or unauthenticated source."*

---

## Trigger

An attacker crafts an MLmodel YAML that specifies `mlflow.statsmodels` as the loader module:

```
flavors:
  python_function:
    loader_module: mlflow.statsmodels
    data: model.pkl
  statsmodels:
    data: model.pkl
    statsmodels_version: 0.14.0
```

With a malicious `model.pkl` placed alongside it in the artifact store, any call to:

```
os.environ["MLFLOW_ALLOW_PICKLE_DESERIALIZATION"] = "False"
mlflow.pyfunc.load_model("models:/MaliciousModel/1")
```

...deserializes the pickle file with **no guard check**, executing arbitrary code with the privileges of the calling process.

On default MLflow deployments (no `--app-name basic-auth`), authentication is disabled, so artifact upload requires no credentials.

---

## Affected Code

- `mlflow/statsmodels/__init__.py` L307-310: `_load_model` — calls `smio.load_pickle` without checking `MLFLOW_ALLOW_PICKLE_DESERIALIZATION`
- `mlflow/statsmodels/__init__.py` L313-320: `_load_pyfunc` — dispatches to `_load_model` without checking the control

Permalink (commit `0b0c576c`):
- https://github.com/mlflow/mlflow/blob/0b0c576c642b5b0d9496c829809c7d097403bc9f/mlflow/statsmodels/__init__.py#L307-L310
- https://github.com/mlflow/mlflow/blob/0b0c576c642b5b0d9496c829809c7d097403bc9f/mlflow/statsmodels/__init__.py#L313-L320

---

## Recommended Fix

Add the missing guard to `mlflow/statsmodels/__init__.py`:

```
from mlflow.environment_variables import MLFLOW_ALLOW_PICKLE_DESERIALIZATION
from mlflow.utils.databricks_utils import (
    is_in_databricks_model_serving_environment,
    is_in_databricks_runtime,
)

def _load_model(path):
    if (
        not MLFLOW_ALLOW_PICKLE_DESERIALIZATION.get()
        and not is_in_databricks_runtime()
        and not is_in_databricks_model_serving_environment()
    ):
        raise MlflowException(
            "Deserializing model using pickle is disallowed, but this statsmodels "
            "model requires pickle deserialization. Set environment variable "
            "'MLFLOW_ALLOW_PICKLE_DESERIALIZATION' to 'true' to allow this."
        )
    import statsmodels.iolib.api as smio
    return smio.load_pickle(path)
```

## Which versions are affected by GHSA-gqvg-gmmx-x4hm?

2 open source packages ship an affected version, including mlflow.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `mlflow` | PyPI | From 2.1.0 | 3.15.0 |
| `mlflow` | PyPI | From 2.1.0 | 3.15.0 |

## How do I fix GHSA-gqvg-gmmx-x4hm?

Upgrade mlflow to 3.15.0 or later.

## Is GHSA-gqvg-gmmx-x4hm being exploited?

There is no known exploitation of GHSA-gqvg-gmmx-x4hm in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-gqvg-gmmx-x4hm and fix it if it is affected.

What it is: GHSA-gqvg-gmmx-x4hm is an unsafe deserialization vulnerability in mlflow, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-gqvg-gmmx-x4hm in the wild and no public exploit code.

Affected packages and fixed versions:
- mlflow (PyPI): affected from 2.1.0; fixed in 3.15.0
- mlflow (PyPI): affected from 2.1.0; fixed in 3.15.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-gqvg-gmmx-x4hm/ (Markdown: https://insights.sbomify.com/GHSA-gqvg-gmmx-x4hm/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-gqvg-gmmx-x4hm

---
From sbomify Insights: https://insights.sbomify.com/GHSA-gqvg-gmmx-x4hm/
Summaries are generated and may contain mistakes; the official description above is the record.