CVE-2026-4137: Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow
In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir() function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions (0o777), and the createmodeldownloadingtmpdir() function in mlflow/pyfunc/init.py creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, and achieve arbitrary code execution when the tampered artifacts are deserialized via cloudpickle.load(). This vulnerability is particularly critical in environments with shared NFS mounts, such as Databricks, where NFS is enabled by default. The issue is a continuation of the vulnerability class addressed in CVE-2025-10279, which was only partially fixed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4137?
CVE-2026-4137 has been classified as a high-severity vulnerability due to its exposure of sensitive data through insecure temporary directory permissions.
How do I fix CVE-2026-4137?
To fix CVE-2026-4137, upgrade to mlflow version 3.11.0 or later, where the issue with world-writable permissions has been resolved.
What versions are affected by CVE-2026-4137?
CVE-2026-4137 affects all versions of mlflow prior to 3.11.0.
What is the nature of the vulnerability in CVE-2026-4137?
CVE-2026-4137 involves insecure temporary directory permissions that allow unauthorized access and modification by any user.
What function in mlflow is associated with CVE-2026-4137?
The vulnerability in CVE-2026-4137 is associated with the `get_or_create_nfs_tmp_dir()` function in the mlflow/utils/file_utils.py file.