---
tags:
- mlflow
- security
- proof-of-concept
- rce
- model-loading
- huntr
- protectai
license: other
---

# MLflow F002 loader_module Guard Bypass RCE

Payload repository for Huntr / ProtectAI triage.

## Finding

RCE: Unvalidated `loader_module` in `MLmodel` YAML bypasses `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` in `mlflow.pyfunc.load_model()`.

## Primary PoC

`proof_f002.py`

## Vulnerable Model Structure

The PoC creates a malicious MLflow model artifact with this structure:

```text
evil_model/
  MLmodel
  code/
    evil_loader.py

The attacker-controlled MLmodel contains:

flavors:
  python_function:
    loader_module: evil_loader
    code: code

MLflow adds the model-controlled code/ directory to sys.path, then imports the attacker-controlled loader_module.

Confirmed Behavior

The exploit was confirmed on MLflow 3.12.0.

The proof explicitly sets:

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False

Confirmed output includes:

UNIQUE_MARKER_F002_LOADER_MODULE_RCE
load_model_return_type: <class 'mlflow.pyfunc.PyFuncModel'>
marker_exists_after: True
marker_content: uid=0(root) gid=0(root) groups=0(root)
F002_CONFIRMED: loader_module imported attacker code while pickle guard was disabled

This confirms attacker-controlled Python code executed during mlflow.pyfunc.load_model() even though pickle deserialization was disabled.

Why This Is Not a Pickle Claim

This PoC does not require a malicious pickle payload.

The root cause is dynamic import of attacker-controlled module metadata:

python_function.loader_module

from attacker-controlled MLmodel YAML after MLflow prepends attacker-controlled model code to Python's import path.

Key Evidence Files
proof_f002.py
RAW/proof_f002_stdout.txt
RAW/proof_f002_stderr.txt
RAW/proof_f002_exit_code.txt
SRC/source_references_f002.txt
SOURCE_REFERENCES.md
ENVIRONMENT.txt
COMMANDS.md
REQUESTS_RESPONSES.md
SHA256SUMS.txt
Scope

Confirmed against:

Repository: mlflow/mlflow
Version: MLflow 3.12.0
Component: mlflow.pyfunc.load_model()
Affected path: Python Function flavor loader dispatch
Security control bypassed: MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False
Impact

An attacker who can cause a target to load an attacker-controlled MLflow model artifact can execute arbitrary Python code in the MLflow process context.

Potential impact includes:

environment variable theft
cloud credential theft
model artifact theft or tampering
CI/CD compromise
lateral movement from model validation or serving infrastructure

This repository intentionally contains only MLflow F002 loader_module guard-bypass RCE artifacts.