CVE-2026-96804

Summary

The flaw allows a remote attacker to execute arbitrary code by exploiting the MLflow statsmodel flavor's lack of deserialization security control.

Exploitability

Exploitation requires a crafted MLmodel artifact, making it moderately difficult. The attacker must have the ability to deliver and deploy the artifact.

Blast radius

If exploited, the impact could be severe, as it allows remote code execution, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to MLflow versions 3.15.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.