CVE-2026-4137: mlflow insecure temporary directory permissions enable code execution

Summary

In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and `_create_model_downloading_tmp_dir()` in `mlflow/pyfunc/__init__.py` creates directories with group-writable permissions (0o770). Local attackers can tamper with cloudpickle-serialized model artifacts and achieve arbitrary code execution when they are loaded via `cloudpickle.load()`. The source calls this especially critical on shared NFS mounts such as Databricks, where NFS is enabled by default, and notes it continues the class addressed in CVE-2025-10279, which was only partially fixed.

Mitigation

Fixed in 3.11.0 (all versions prior to 3.11.0 are affected).

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Related items

• MediumOver 1,500 npm packages exposed by Trusted Publishing validation flawSimilar attack · CSO Online
• MediumCVE-2026-108958: TensorLayer HDF5 model loading deserialization via model_config argumentSimilar attack · NVD/CVE Database
• InfoHow to Secure AI Models in Production Environments | Endor LabsSimilar attack · Endor Labs Blog
• InfoWhat Does It Mean to Sandbox an AI Coding Agent? | Endor LabsSimilar attack · Endor Labs Blog
• InfoIntroducing Security for AI Coding Agents and Workstations | Endor LabsSimilar attack · Endor Labs Blog