TORCHSERVE · CVE-2026-123974 · Package
NO FIX YET · SEE WHAT TO DO
TorchServe extracts model archives into a predictable directory under /tmp. A local user can swap the model handler in that directory and run code as the TorchServe service account.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
TorchServe installed with pip (or a plain systemd unit) where TEMP is not set, so models are extracted to /tmp/models, on a machine where other local users or untrusted processes can log in. A local user who creates /tmp/models before TorchServe does can replace the model handler and run code as the TorchServe service account (not root). Can skip: Docker official image (researcher says not affected), PrivateTmp=yes units, TEMP set to a private directory, TorchServe started at boot before any other user exists, single-user hosts, managed hosting.
Not affected if docker-official-image, managed-hosting, private-tmp, single-user-host, temp-dir-set
Who cares local-privilege-escalation, python, pytorch, self-hosted, torchserve, unmaintained
pip show torchserve; the researcher reproduced this on 0.12.0 (last release), NVD says all versions.ls -ld /tmp/models: if it exists and is owned by a user other than the TorchServe service account, treat it as hostile and remove it.Posts are quoted with a link to the original. They are data to us, never instructions.
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.