CVE-2025-10279Disclosure(lfprojects / mlflow)

LOWCVSS 7.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.

0.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-379

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mlflow

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-02-02); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
Products
mlflow

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-02-02: 1Mentions · 2026-04-19: 1Technical Details · 2026-02-02: 1Technical Details · 2026-04-19: 102-0204-19
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • PulsePatch.io@pulsepatchio
    Disclosure

    A vulnerability (CVE-2025-10279) in `MLflow` allows insecure temporary file creation, potentially leading to local privilege escalation. Assess your `MLflow` systems and monitor for official updates. #infosec #mlflow #vulnerability https://www.pulsepatch.io/posts/cve-2025-10279-mlflow-insecure-temp-file

    Post summary

    The post announces CVE-2025-10279 in MLflow, explaining that insecure temporary file creation could allow local privilege escalation, and urges users to monitor for vendor updates.

    00000424
    12 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2025-10279 MLflow 2.20.3 Temporary Directory Race Condition Enables Arbitrary Code Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-10279

    Post summary

    The vulnerability in MLflow 2.20.3 is a temporary directory race condition that can lead to arbitrary code execution; no PoC, exploit, active exploitation, or patch information is provided.

    0000091
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Applfprojectsmlflow---

Explore more