PT-2026-41733 · Mlflow · Mlflow

Published 2026-05-18 · Updated 2026-05-19 · CVE-2026-4137

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mlflow versions prior to 3.11.0

Description The get or create nfs tmp dir() function in mlflow/utils/file utils.py creates temporary directories with world-writable permissions (0o777), and the create model downloading tmp dir() function in mlflow/pyfunc/ init .py creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, leading to arbitrary code execution when the tampered artifacts are deserialized via cloudpickle.load(). This issue is especially critical in environments with shared NFS (Network File System) mounts, such as Databricks, where NFS is enabled by default.

Recommendations Update to version 3.11.0 or later. As a temporary workaround, restrict access to the get or create nfs tmp dir() and create model downloading tmp dir() functions or the directories they create to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-378

Related Identifiers

CVE-2026-4137

Affected Products

Mlflow

References · 7

• 🔥 https://huntr.com/bounties/648dc30b-76c7-4433-86b8-f43d926fd8d6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4137 · Security Note
• https://github.com/mlflow/mlflow/commit/1dcbb0c2fbd1f446c328830e601ca13a28219b8a · Note
• https://twitter.com/infoflowcloud/status/2056671599802093744 · Twitter Post
• https://twitter.com/CVEnew/status/2056670126196531296 · Twitter Post
• https://t.me/cveNotify/163930 · Telegram Post
• https://t.me/CVEtracker/54171 · Telegram Post