# CVE-2026-123974: PyTorch TorchServe local privilege escalation in model extraction

Source: https://junglewise.ai/threats/cve-2026-123974-in-all-versions-of-pytorch-s-torchserve-a-predictable-extraction  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123974 · Severity: high · CVSS 7.8 · Published 2026-11-06

TorchServe is a machine learning model serving framework that extracts and runs model handlers as code. A local attacker can create a world-writable directory in /tmp that TorchServe will use to extract models, then swap the legitimate handler code with malicious code, causing it to execute with the privileges of the TorchServe service account. This enables local privilege escalation without requiring root access or exploiting a race condition.

Vendors: [PyTorch](https://junglewise.ai/threats/vendors/pytorch).

## Quick answers

**Is CVE-2026-123974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123974 being exploited in the wild.

**How severe is CVE-2026-123974?** High severity, with a CVSS score of 7.8, published 6 November 2026.

**Which products and versions are affected?** PyTorch TorchServe 0.12.0 and likely earlier versions; complete affected range to be determined.

**Is there a fix for CVE-2026-123974?** No fixed version is recorded yet. Set the TEMP environment variable to a directory outside /tmp with restrictive permissions (e.g., mode 0700) owned by the TorchServe service account before starting the service. Alternatively, explicitly configure java.io.tmpdir via JVM arguments to a protected location. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123974 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-123974?** Check whether you run PyTorch TorchServe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Set the TEMP environment variable to a directory outside /tmp with restrictive permissions (e.g., mode 0700) owned by the TorchServe service account before starting the service. Alternatively, explicitly configure java.io.tmpdir via JVM arguments to a protected location.

## Technical details

The vulnerability exploits TorchServe's use of a predictable, fixed extraction directory (/tmp/models) with no ownership validation. When the TEMP environment variable is not set, the JVM defaults to /tmp as java.io.tmpdir. An unprivileged local user can pre-create /tmp/models with world-writable permissions (mode 0777), then monitor for model extraction and swap the handler.py file before the worker imports it. The attacker owns the parent directory, allowing directory-level operations (rename) regardless of file ownership, bypassing the sticky bit protection that would apply to /tmp itself.

## Affected products

- PyTorch TorchServe 0.12.0 and likely earlier versions; complete affected range to be determined

## Timeline

- 2026-07-28: disclosed: Reported to PyTorch security contacts
- 2026-11-06: advisory: CVE-2026-123974 published

## References

- [https://christbowel.com/blog/torchserve-lpe/](https://christbowel.com/blog/torchserve-lpe/)
- [https://github.com/Christbowel/torchserve-lpe](https://github.com/Christbowel/torchserve-lpe)