CVE-2024-37056

Summary

CVE-2024-37056 is a deserialization vulnerability affecting versions 1.23.0 and newer of the MLflow platform. This issue allows a maliciously crafted LightGBM scikit-learn model, which can be uploaded to the platform, to execute arbitrary code on an end user's system when the model is interacted with. An attacker could leverage this vulnerability to gain unauthorized access to sensitive data or even take control of the affected system. Users are encouraged to update to the latest version of MLflow to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.