Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
En bref
Sévérité
HIGH 7.0
EPSS
EPSS 0.12 % · centile 2 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
JFROG
Statut NVD
Analyzed
Description
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
GHSA-qpgc-w4mg-6v92 — MLflow's excessive directory permissions allow local privilege escalation
PYSEC-2024-224 — Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain e
