CVE-2025-10279
In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.
Scoring
- Severity
- HIGH
- CVSS base score
- 7
- CVSS vector
- CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.22%
- CWE
- CWE-379
- Published
- 2026-02-02
- Last modified
- 2026-03-12
Affected products
- mlflow mlflow/mlflow
Weakness type
Related vulnerabilities
- CVE-2026-69482 — Windows Error Reporting Tampering Vulnerability
- CVE-2026-85028 — Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit
- CVE-2026-82346 — HP ImageDiags - Potential Escalation of Privilege
- CVE-2026-63693 — Dell Client BIOS contains an Improper Link Resolution Before File Access ('Link Following')...
- CVE-2026-12555 — HP Easy Start for macOS - Security Update
- CVE-2026-50544 — NortheBridge/luminalshine has Incorrect Permission Assignment for Critical Resource and Creation of Temporary File in Directory with Insecure Permissions
- CVE-2026-14551 — Local Privilege Escalation in servereye client (sensorhub)
- CVE-2026-46388 — osquery: Unprivileged users can temporarily read file carve contents