Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 MLflow, Security Control Bypass (Pickle Deserialization), #CVE-2024-37052–#CVE-2024-37060 (Critical) -DC-Sep2026-2059 https://dailycve.com/mlflow-security-control-bypass-pickle-deserialization-cve-2024-37052-cve-2024-37060-critical-dc-sep2026-2059/
Post summary
The passage identifies a critical MLflow vulnerability involving pickle deserialization that allows security control bypass, covering CVE‑2024‑37052 through CVE‑2024‑37060.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | lfprojects | mlflow | - | - | - |