MLflow statsmodels flavor bypasses pickle deserialization safety control

The MLflow project has disclosed a high-severity security advisory, GHSA-gqvg-gmmx-x4hm, published on September 1, 2026, regarding a vulnerability in the `mlflow.statsmodels` flavor. According to the GitHub Security Advisory database, the issue allows an attacker to bypass the `MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False` safety control, which was designed to prevent unsafe `pickle.load` operations during model loading. This bypass enables remote code execution (RCE) if a crafted model artifact is loaded via `mlflow.pyfunc.load_model()`. The vulnerability arises because the `mlflow.statsmodels` flavor omits the necessary guard against unsafe deserialization, directly invoking `pickle.load` through `statsmodels.iolib.api.load_pickle`.

Operators should carefully inspect their artifact stores for any untrusted or unexpected MLmodel files that specify the `mlflow.statsmodels` flavor as the loader module. Additionally, environments relying on the `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` flag for security should reassess their exposure, as this flag does not provide protection against malicious artifacts in the `statsmodels` flavor. This advisory highlights the importance of verifying security controls across all flavors in a project, as gaps in implementation can undermine the intended mitigation strategy.