MLflow's statsmodel flavor, between versions 2.1.0 and 3.14.0, accidentally omits a critical security configuration that disables pickle deserialization. This missing guard allows a maliciously crafted MLmodel artifact to be deserialized, resulting in arbitrary code execution with the privileges of the MLflow server or client process. The flaw is a classic example of the improper deserialization weakness identified as CWE-502.

The vulnerability affects organizations that run MLflow, specifically the statsmodel flavor, in any version from 2.1.0 up to and including 3.14.0. No other MLflow versions or flavors are currently reported as affected.

The CVSS score of 8.8 indicates high severity, but the EPSS score is not available, so it is unclear how frequently this vulnerability is being exploited in the wild. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is a remote attacker uploading or embedding a malicious MLmodel artifact into a workflow that MLflow processes. Because the check is entirely absent, any untrusted artifact will trigger code execution, potentially compromising the machine or network where MLflow is hosted.