MLflow: MLFlow Creates a Temporary File With Insecure Permissions
MLflow
More for MLflow RSS feed for MLflow
- Severity
- High, CVSS 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-4137
- Affects
- MLflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 18, 2026
- Source last modified
- September 1, 2026
Description
In mlflow/mlflow versions prior to 3.11.0, the get_or_create_nfs_tmp_dir() function in mlflow/utils/file_utils.py creates temporary directories with world-writable permissions (0o777), and the _create_model_downloading_tmp_dir() function in mlflow/pyfunc/__init__.py creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, and achieve arbitrary code execution when the tampered artifacts are deserialized via cloudpickle.load(). This vulnerability is particularly critical in environments with shared NFS mounts, such as Databricks, where NFS is enabled by default. The issue is a continuation of the vulnerability class addressed in CVE-2025-10279, which was only partially fixed.
Description quoted from the NVD record.
Who is affected
MLflow, made by LF Projects, is a platform for building, tracking and running machine learning models. This flaw affects versions before 3.11.0. When MLflow handles saved models, it creates temporary folders that other users on the same system can change. Someone who already has access to that system could tamper with stored model files and make their own code run when MLflow loads the model. The risk is greatest where several users share network storage, such as Databricks, where this shared storage is turned on by default. This flaw is rated High.
What to do
- Find out who installed or runs MLflow for your organization, such as a staff member, volunteer or IT provider, since that person should act on this flaw.
- Update MLflow to version
3.11.0or later, which fixes this flaw. - If an IT provider or vendor runs MLflow for you, send them this advisory and ask when the update will be done.
- Update first any MLflow setup where several people share the same system or network storage, such as Databricks, because the risk from this flaw is greatest there.
Analysis written from the source record as of September 1, 2026 and reviewed before publishing.