The vulnerability in mlflow stems from temporary directories created by get_or_create_nfs_tmp_dir and _create_model_downloading_tmp_dir being writable by all users (world‑writable 0o777) or by the group (0o770). This insecure permissions flaw (CWE‑378) allows a local attacker on systems that use shared NFS mounts such as Databricks to replace or modify model artifact files. When mlflow deserializes these artifacts with cloudpickle.load(), the injected code is executed with the privileges of the mlflow process, providing arbitrary code execution. The flaw is a continuation of the previously partially fixed vulnerability CVE‑2025‑10279 and remains unaddressed until the next major release.

The affected product is the mlflow library. Any installation of mlflow with a version earlier than 3.11.0 is vulnerable, regardless of the operating system. The issue arises in the file utilities and pyfunc modules, so any code that imports these modules and passes model artifacts to cloudpickle through mlflow may be impacted.

The CVSS score of 7.8 indicates high severity. The EPSS score of < 1% indicates a very low likelihood of exploitation, yet the vulnerability still exists. The vulnerability is not listed in CISA KEV. The likely attack vector requires a local attacker who can write to the shared NFS directory used by mlflow. By placing malicious files into that directory and then causing mlflow to load a model, the attacker can trigger arbitrary code execution. While exploitation needs local file‑system access, the potential impact is full control over any process that deserializes the tampered artifacts.