MLflow CVE-2026-4137

Attacker must already have local shell access to a host that shares the MLflow staging filesystem - specifically either the NFS tmp directory created by get_or_create_nfs_tmp_dir() (mode 0o777, exploitable by any local user) or the pyfunc model-downloading tmp directory (mode 0o770, exploitable by any user in the owning group). A second victim process must subsequently load the tampered artifact via cloudpickle.load() (i.e., mlflow.pyfunc.load_model or equivalent) for code execution to fire, so a single-user MLflow install with no other principals on the box is not exploitable. The condition is acutely met in Databricks deployments where NFS is enabled by default and multiple workloads share the mount; it is NOT met by network-only attackers (CVSS AV:L confirms local vector), and it is mitigated where the staging path lives on a per-user filesystem or where MLflow is run by a single dedicated service account with no other local users.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) correctly reflects that exploitation requires a local foothold and low-privileged shell access, not network reach - so this is not an internet-exposed RCE despite the RCE tag. EPSS is 0.01% (0th percentile) and SSVC marks exploitation as 'poc' with Automatable=no and Technical Impact=total, which is internally consistent: total impact when triggered, but tied to specific deployment topologies (shared NFS, multi-tenant Databricks/Spark clusters). The vulnerability is not in CISA KEV and no public exploit is identified at time of analysis, so priority should be high for multi-tenant ML platforms and shared-tenant Databricks workspaces but materially lower for single-tenant or single-user MLflow deployments where no second principal can reach the temp directories.

A low-privileged user on a shared Databricks cluster or any host mounting the MLflow NFS staging directory waits for or triggers a model download into the world-writable tmp directory, then overwrites the cloudpickle artifact with a malicious pickle whose __reduce__ method invokes a reverse shell or arbitrary command. When a higher-privileged data scientist or service account subsequently calls mlflow.pyfunc.load_model() and cloudpickle.load() deserializes the tampered file, the attacker's payload executes with that victim's identity and access to model registries, credentials, and data. No public PoC is identified at time of analysis, but the SSVC 'poc' rating and the straightforward nature of pickle abuse make weaponization trivial for anyone with local access.