216.73.217.22

CVE-2026-4137

· Published 18/05/2026 21:16 · Modified 19/05/2026 15:03

Labels: CVE-2026-4137 2026-05-18CVE-2026-4137CWE-378[email protected]

Essential information

Published
18/05/2026 21:16
Modified
19/05/2026 15:03
Author
Creator
CVSS
7.0 HIGH (v3.0)
CISA KEV
No
CWE
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS metrics

Description

In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` function in `mlflow/pyfunc/__init__.py` creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, and achieve arbitrary code execution when the tampered artifacts are deserialized via `cloudpickle.load()`. This vulnerability is particularly critical in environments with shared NFS mounts, such as Databricks, where NFS is enabled by default. The issue is a continuation of the vulnerability class addressed in CVE-2025-10279, which was only partially fixed.

NVD status

Status
Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
mlflow / mlflow cpe:2.3:a:mlflow:mlflow:<3.11.0:*:*:*:*:*:*:*

References