In mlflow/mlflow versions before 3.11.0, the functions get_or_create_nfs_tmp_dir() and _create_model_downloading_tmp_dir() create temporary directories with overly permissive permissions (0o777 and 0o770 respectively). These insecure permissions allow local attackers with access to the filesystem to modify model artifacts, including cloudpickle-serialized Python objects. When these tampered artifacts are later deserialized using cloudpickle.load(), it can result in arbitrary code execution. This vulnerability is particularly impactful in shared NFS mount environments such as Databricks, where NFS is enabled by default. The vulnerability is a continuation of the CWE-378 class and relates to a previously partially fixed issue identified as CVE-2025-10279.

The vulnerability allows local attackers to modify temporary directories and model artifacts due to insecure directory permissions. This can lead to arbitrary code execution upon deserialization of tampered artifacts, posing a high risk to confidentiality, integrity, and availability of the affected system. The impact is heightened in shared NFS environments where multiple users have access to the same filesystem.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor mlflow vendor advisories for updates. Until a patch is available, restrict local access to shared NFS mounts and avoid running untrusted code that deserializes model artifacts. Review and harden permissions on temporary directories used by mlflow to prevent unauthorized modifications.