Executive brief
MLflow, a platform for managing machine learning lifecycles, was found to create temporary directories with insecure permissions. This flaw allows a local attacker on the same system to modify machine learning model files before they are loaded. If exploited, this could lead to the execution of malicious code, potentially compromising the integrity of AI models and the security of the underlying server or cloud environment.
Technical details
A vulnerability exists in MLflow's handling of temporary directories within `mlflow/utils/file_utils.py` and `mlflow/pyfunc/__init__.py`. Specifically, the functions `get_or_create_nfs_tmp_dir()` and `_create_model_downloading_tmp_dir()` create directories with 0o777 (world-writable) and 0o770 (group-writable) permissions, respectively. A local attacker can exploit these insecure permissions to tamper with model artifacts, such as cloudpickle-serialized Python objects, during the download or creation process. When these tampered artifacts are subsequently deserialized via `cloudpickle.load()`, the attacker achieves arbitrary code execution. This is particularly impactful in shared environments like Databricks where NFS is used. The issue is addressed in version 3.11.0.
Affected products
- mlflow mlflow < 3.11.0
Timeline
- 2026-05-18: disclosed
- 2026-05-18: advisory
- 2026-05-18: patched: Version 3.11.0 released