GHSA-f2m9-wcf4-cwwx

Suggest an improvement
Source
https://github.com/advisories/GHSA-f2m9-wcf4-cwwx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-f2m9-wcf4-cwwx/GHSA-f2m9-wcf4-cwwx.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-f2m9-wcf4-cwwx
Aliases
Downstream
Published
2026-05-18T21:31:53Z
Modified
2026-09-01T01:15:06Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
MLFlow Creates a Temporary File With Insecure Permissions
Details

In mlflow/mlflow versions prior to 3.11.0, the get_or_create_nfs_tmp_dir() function in mlflow/utils/file_utils.py creates temporary directories with world-writable permissions (0o777), and the _create_model_downloading_tmp_dir() function in mlflow/pyfunc/__init__.py creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, and achieve arbitrary code execution when the tampered artifacts are deserialized via cloudpickle.load(). This vulnerability is particularly critical in environments with shared NFS mounts, such as Databricks, where NFS is enabled by default. The issue is a continuation of the vulnerability class addressed in CVE-2025-10279, which was only partially fixed.

Database specific 
{
    "cwe_ids":  [
        "CWE-378"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-29T19:53:36Z",
    "nvd_published_at":  "2026-05-18T21:16:40Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / mlflow

Package

Name
mlflow
View open source insights on deps.dev
Purl
pkg:pypi/mlflow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.26.0
Fixed
3.11.0

Affected versions

1.*
1.26.0
1.26.1
1.27.0
1.28.0
1.29.0
1.30.0
1.30.1
2.*
2.0.0rc0
2.0.0
2.0.1
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.9.0
2.9.1
2.9.2
2.10.0
2.10.1
2.10.2
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.13.2
2.14.0rc0
2.14.0
2.14.1
2.14.2.dev0
2.14.2
2.14.3
2.15.0rc0
2.15.0
2.15.1
2.16.0
2.16.1
2.16.2
2.17.0rc0
2.17.0
2.17.1
2.17.2
2.18.0rc0
2.18.0
2.19.0rc0
2.19.0
2.20.0rc0
2.20.0
2.20.1
2.20.2
2.20.3
2.20.4
2.21.0rc0
2.21.0
2.21.1
2.21.2
2.21.3
2.22.0rc0
2.22.0
2.22.1
2.22.2
2.22.3
2.22.4
2.22.5
3.*
3.0.0rc0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0
3.0.1
3.1.0rc0
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0rc0
3.2.0
3.3.0rc0
3.3.0
3.3.1
3.3.2
3.4.0rc0
3.4.0
3.5.0rc0
3.5.0
3.5.1
3.6.0rc0
3.6.0
3.7.0rc0
3.7.0
3.8.0rc0
3.8.0
3.8.1
3.9.0rc0
3.9.0
3.10.0rc0
3.10.0
3.10.1
3.11.0rc0
3.11.0rc1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-f2m9-wcf4-cwwx/GHSA-f2m9-wcf4-cwwx.json"