CVE-2026-4137
In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` function in `mlflow/pyfunc/__init__.py` creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, and achieve arbitrary code execution when the tampered artifacts are deserialized via `cloudpickle.load()`. This vulnerability is particularly critical in environments with shared NFS mounts, such as Databricks, where NFS is enabled by default. The issue is a continuation of the vulnerability class addressed in CVE-2025-10279, which was only partially fixed.
Scoring
- Severity
- HIGH
- CVSS base score
- 7
- CVSS vector
- CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.19%
- CWE
- CWE-378
- Published
- 2026-05-18
- Last modified
- 2026-05-19
Affected products
- mlflow mlflow/mlflow
Weakness type
Related vulnerabilities
- CVE-2026-46388 — osquery: Unprivileged users can temporarily read file carve contents
- CVE-2026-33572 — OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript Files
- CVE-2026-4822 — Enter Software Iperius Backup Backup Service temp file
- CVE-2026-2817 — Spring Data Geode Insecure Temporary Directory Usage
- CVE-2025-46685 — Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File...
- CVE-2025-46684 — Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File...
- CVE-2025-34352 — JumpCloud Remote Assist < 0.317.0 Arbitrary File Write/Delete via Insecure Temp Directory
- CVE-2025-7647 — Insecure Temporary File Handling in run-llama/llama_index