BardLaudian/CVE-2024-37054

PoC

Generic PoC for MLflow pickle deserialization RCE (CVE-2024-37054-style). Poisons a registered model via the MLflow REST API to achieve code execution when the model is loaded.

view exploit source poc_in_githubauthor BardLaudianpublished 2026-09-23catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2024-37054UShigh8.8Exploit
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on…
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan