Mmastodon TechnologyCybersecurity first seen 2 d ago, last 2 d ago, peak #4

MLflow vulnerability allows remote code execution via pickle deserialization

Original: 🚨 EUVD-2026-116619 📊 Score: 7.8/10 (CVSS v3.1) 📦 Product: MLflow 🏢 Vendor: mlflow 📅 Updated: 2026-11-04 📝 MLflow PickleE

A new vulnerability, EUVD-2026-116619, has been documented in MLflow, an open-source machine learning platform. The flaw, rated 7.8 out of 10 on the CVSS v3.1 scale, involves insecure deserialization of PickleEvaluationArtifact data, which could let remote attackers execute arbitrary code on affected systems. The advisory was updated on November 4, 2026, and security teams monitoring MLflow deployments are being urged to review their exposure and apply mitigations.

Why now: The advisory was newly updated, prompting security professionals to assess and patch affected MLflow deployments.

MLflowEUVDCVSS

Open on mastodon →

Rank over time, top of the chart is #1. 2 snapshots from 2 d ago to 2 d ago.

Evidence

• 🚨 EUVD-2026-116619 📊 Score: 7.8/10 (CVSS v3.1) 📦 Product: MLflow 🏢 Vendor: mlflow 📅 Updated: 2026-11-04 📝 MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/4815619