The vulnerability lies in MLflow’s dspy flavor, which incorrectly applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION security control only when the model_path ends in .pkl. As a result, a remote attacker can place a malicious model artifact with a different file extension and trigger arbitrary code execution when the artifact is deserialized. The flaw is essentially a bypass of a deserialization restriction, enabling arbitrary code execution on the host running the MLflow service.

Affected systems are installations of the MLflow library, specifically the dspy flavor for model serving, version 2.0 and later. The problem is present in any patch or minor release within that range unless the publisher releases a fix. Organizations using MLflow for deploying machine learning models should identify whether they rely on dspy and review the version in use.

The CVSS score is 8.8, but the nature of the flaw suggests a high severity risk. Because the attack vector is remote and does not require authentication, an exploitation would allow a threat actor to execute code on an MLflow host by delivering a crafted MLmodel artifact. The EPSS score is currently unavailable and KEV is not listed, but the lack of mitigation could be exploited by attackers with sufficient knowledge of the service. System owners should consider the risk to be significant until a remediation is applied.