Answer in brief
CVE-2026-4137 records a High severity (CVSS 7.0) vulnerability in MLFlow Creates a Temporary File With Insecure Permissions. The current sources do not mark it as known exploited. The current feed maps mlflow (pip). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps mlflow (pip). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| mlflowpip | >=1.26.0,<3.11.0 | 3.11.0 |
Published upstream
May 18, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Sep 1, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Sep 1, 2026
In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` function in `mlflow/pyfunc/__init__.py` creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, and achieve arbitrary code execution when the tampered artifacts are deserialized via `cloudpickle.load()`. This vulnerability is particularly critical in environments with shared NFS mounts, such as Databricks, where NFS is enabled by default. The issue is a continuation of the vulnerability class addressed in CVE-2025-10279, which was only partially fixed.
Quoted source text, attributed separately from HOL analysis.