MLflow up to 3.10.x file_utils.py get_or_create_nfs_tmp_dir temp file

Summaryinfo

A vulnerability classified as problematic has been found in MLflow up to 3.10.x. The impacted element is the function get_or_create_nfs_tmp_dir of the file mlflow/utils/file_utils.py. Performing a manipulation results in temp file. This vulnerability was named CVE-2026-4137. The attack needs to be approached locally. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in MLflow up to 3.10.x. This affects the function get_or_create_nfs_tmp_dir of the file mlflow/utils/file_utils.py. The manipulation with an unknown input leads to a temp file vulnerability. CWE is classifying the issue as CWE-378. Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` function in `mlflow/pyfunc/__init__.py` creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, and achieve arbitrary code execution when the tampered artifacts are deserialized via `cloudpickle.load()`. This vulnerability is particularly critical in environments with shared NFS mounts, such as Databricks, where NFS is enabled by default. The issue is a continuation of the vulnerability class addressed in CVE-2025-10279, which was only partially fixed.

It is possible to read the advisory at huntr.com. This vulnerability is uniquely identified as CVE-2026-4137 since 03/13/2026. The exploitability is told to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.11.0 eliminates this vulnerability. Applying the patch 1dcbb0c2fbd1f446c328830e601ca13a28219b8a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• MLflow

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10

License

• open-source

Website

• Product: https://github.com/mlflow/mlflow/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion