CVE-2025-10279: Privilege Escalation in mlflow/mlflow

Published Feb 2, 2026
·
Updated

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the /tmp directory to exploit a race condition and overwrite .py files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.

Affected Software

4 affected componentsFixes available
pypi/mlflow
pypi/mlflow<3.4.0
pip/mlflow<3.4.0rc0
3.4.0rc0
Lfprojects Mlflow<3.4.0

Event History

Feb 2, 2026
CVE Published
via MITRE·10:36 AM
Data Sourced
via MITRE·10:36 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:16 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:16 AM
RemedyAffected Software
Advisory Published
via GitHub·12:31 PM
Data Sourced
via GitHub·12:31 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-10279?

CVE-2025-10279 is classified as a privilege escalation vulnerability due to insecure world-writable permissions.

2

How do I fix CVE-2025-10279?

To fix CVE-2025-10279, ensure the temporary directory used for creating Python virtual environments has secure permissions set to prevent unauthorized access.

3

Who is affected by CVE-2025-10279?

CVE-2025-10279 affects users of mlflow versions up to and including 2.20.3.

4

What causes CVE-2025-10279?

CVE-2025-10279 is caused by the temporary directory created for Python virtual environments being assigned insecure permissions (0o777).

5

Can CVE-2025-10279 be exploited remotely?

CVE-2025-10279 requires local write access to the /tmp directory, therefore it is not a remote exploit.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203