CVE-2026-4137: MLflow arbitrary code execution via insecure temporary directory permissions

CVE-2026-4137 · Severity: high · CVSS 7 · Published 2026-05-18

MLflow, a platform for managing machine learning lifecycles, was found to create temporary directories with insecure permissions. This flaw allows a local attacker on the same system to modify machine learning model files before they are loaded. If exploited, this could lead to the execution of malicious code, potentially compromising the integrity of AI models and the security of the underlying server or cloud environment.

Technologies: mlflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-4137 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4137 being exploited in the wild.
How severe is CVE-2026-4137?
High severity, with a CVSS score of 7, published 18 May 2026.
Which products and versions are affected?
mlflow (PyPI) < 3.11.0, ECOSYSTEM:introduced=0,fixed=3.11.0, ECOSYSTEM:introduced=1.26.0,fixed=3.11.0.
Is there a fix for CVE-2026-4137?
Yes. mlflow (PyPI): upgrade to 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4137 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-4137?
Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mlflow (PyPI): upgrade to 3.11.0 or later
    pip install "mlflow>=3.11.0"

Technical details

A vulnerability exists in MLflow's handling of temporary directories within `mlflow/utils/file_utils.py` and `mlflow/pyfunc/__init__.py`. Specifically, the functions `get_or_create_nfs_tmp_dir()` and `_create_model_downloading_tmp_dir()` create directories with 0o777 (world-writable) and 0o770 (group-writable) permissions, respectively. A local attacker can exploit these insecure permissions to tamper with model artifacts, such as cloudpickle-serialized Python objects, during the download or creation process. When these tampered artifacts are subsequently deserialized via `cloudpickle.load()`, the attacker achieves arbitrary code execution. This is particularly impactful in shared environments like Databricks where NFS is used. The issue is addressed in version 3.11.0.

Affected products

  • mlflow mlflow < 3.11.0

Identifiers

  • CVE-2026-4137
  • GHSA-f2m9-wcf4-cwwx
  • PYSEC-2026-2655

Timeline

  • 2026-05-18: disclosed
  • 2026-05-18: advisory
  • 2026-05-18: patched: Version 3.11.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.