pytorch/serve: Local privilege escalation through insecure temporary path
Affects TorchServe 0.12.0 when TEMP is unset so models extract to /tmp/models, which a local user can pre-create. The project is archived and no permanent fix is scheduled.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects TorchServe 0.12.0 (commit 62c4d6a1) The TEMP environment variable is unset, so extraction goes to /tmp/models An attacker owns /tmp/models before TorchServe creates it, e.g. the service is started while ordinary users are logged in The systemd unit is not hardened with PrivateTmp=yes
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 34/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
TorchServe, PyTorch's model-serving software, has a local privilege escalation flaw caused by a predictable extraction directory in /tmp. A local user with low-level access can swap the model handler and run code as the TorchServe service account.
Read the original description
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.
cve.now Index
- Exploitation15/40CISA rates a proof of concept as public
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.8/10CVSS 7.8, total technical impact per CISA
- No patch5/5No patch listed yet
What would change the score
- Would score about 69 if added to CISA KEV
- Would score about 64 if CISA's SSVC rates exploitation active
- Would score about 44 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affects TorchServe 0.12.0 (commit 62c4d6a1) The TEMP environment variable is unset, so extraction goes to /tmp/models An attacker owns /tmp/models before TorchServe creates it, e.g. the service is started while ordinary users are logged in The systemd unit is not hardened with PrivateTmp=yesWorkaround: Set TEMP (or pass -Djava.io.tmpdir) to a directory the service account owns and that is not world-writable, or harden the systemd unit with PrivateTmp=yes, or extract into a service-owned directory
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- PyTorch TorchServe
All versions
Evidence 2
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123974
Is CVE-2026-123974 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
TorchServe extracts models into a temporary directory. If a local user creates that directory first, TorchServe can run code as the TorchServe service account, which lets a local user escalate privileges to that account.Source: christbowel.com, cve.org
Which versions are affected by CVE-2026-123974?
TorchServe: all versions.Source: cve.now feed data
Am I affected, and how do I check?
The advisory lists TorchServe 0.12.0 (commit 62c4d6a1) as affected. The setup involves the TEMP environment variable being unset, so extraction goes to /tmp/models, and a systemd unit without PrivateTmp=yes. Check the installed TorchServe version, whether TEMP is set for the service, and whether the unit sets PrivateTmp=yes.Source: christbowel.com, cve.org
How do I fix CVE-2026-123974?
The facts list no fixed version, so no upgrade target is given. Apply one of the workarounds in the no-patch answer.Source: christbowel.com, cve.org
What if there's no patch?
Set TEMP, or pass -Djava.io.tmpdir, to a directory the service account owns that is not world-writable. Alternatively, add PrivateTmp=yes to the systemd unit, or extract models into a service-owned directory. The project is archived and no permanent solution is scheduled.Source: christbowel.com, cve.org