Skip to content
Sign in
7.8 High

CVE-2026-123974 pytorch/serve: Local privilege escalation through insecure temporary path

Description

In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.

CVSS 3.1 detail

Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
Low
Privileges required
Low
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
torchserve Versions not published

Other CVEs of torchserve

The 3 CVEs of torchserve →
CVE-2024-35199 TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production 8.2 High CVE-2023-43654 TorchServe is a tool for serving and scaling PyTorch models in production 10.0 Critical
Track this CVE