{"id":"CVE-2026-123974","kind":"vulnerability","aliases":["CVE-2026-123974"],"related":[],"title":"PyTorch TorchServe: predictable /tmp directory lets local user run code","description":"In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.","summary":"TorchServe extracts model archives into a predictable directory under /tmp. A local user can swap the model handler in that directory and run code as the TorchServe service account.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"torchserve","fixed":[],"affected":"all versions (reproduced on 0.12.0, the last release)","ecosystem":"pypi"}],"ecosystems":[],"tags":["local-privilege-escalation","package","python","pytorch","self-hosted","torchserve","unmaintained"],"not_affected_if":["docker-official-image","managed-hosting","private-tmp","single-user-host","temp-dir-set"],"how_to_check":"- Run `pip show torchserve`; the researcher reproduced this on 0.12.0 (last release), NVD says all versions.\n- Check whether the TEMP environment variable is set for the TorchServe process; if unset, models extract to /tmp/models.\n- Run `ls -ld /tmp/models`: if it exists and is owned by a user other than the TorchServe service account, treat it as hostile and remove it.\n- If TorchServe runs under systemd, check the unit for PrivateTmp=yes (this blocks the attack).\n- Also check if you start TorchServe by hand while other users are logged in, or run a /tmp cleaner.","fix":"No fix: the pytorch/serve repository is archived and its README says no security patches are planned. Workaround from the researcher (not the vendor): set TEMP (or -Djava.io.tmpdir) to a directory owned by the service account and not world-writable, or add PrivateTmp=yes to the systemd unit.","status":"open","published_at":"2026-11-06T20:17:20+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","triaged_at":"2026-11-06T20:44:13+00:00","updated_at":"2026-11-06T20:45:25+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T20:44:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"PyTorch TorchServe: predictable /tmp directory lets local user run code","impact":"high","summary":"TorchServe extracts model archives into a predictable directory under /tmp. A local user can swap the model handler in that directory and run code as the TorchServe service account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["torchserve","pytorch","python","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user runs code as the TorchServe service account","analyst_note":"Check the PyTorch TorchServe security advisory and the NVD entry for affected version ranges and a fixed release.","how_to_check":"- Check whether TorchServe is installed and which version is running, for example with `pip show torchserve`\n- Look for a predictable extraction directory under `/tmp` used by TorchServe model loading\n- unknown for a fixed version: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["single-user-host","managed-hosting"],"who_is_affected":"Hosts where TorchServe runs and where other local users or untrusted processes share the machine. The risk is local privilege escalation, so a server with only trusted local accounts is lower risk. unknown for the exact configuration the sources name.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00067,"input_tokens":4193,"output_tokens":502,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the PyTorch TorchServe security advisory and the NVD entry for affected version ranges and a fixed release.","search":"'-123974':13A,16A '-2026':12A,15A '/tmp':4A,39B,71C 'account':58B,87C 'archiv':33B 'code':10A,53B,82C 'cve':11A,14A 'directori':5A,37B,50B,69C 'escal':21B,92C 'extract':31B,68C 'handler':47B,79C 'host':27B 'lead':88C 'let':6A,72C 'local':7A,19B,41B,74C,90C 'local-privilege-escal':18B 'model':32B,46B,78C 'packag':22B 'predict':3A,36B,67C 'privileg':20B,91C 'python':23B 'pytorch':1A,24B,63C 'run':9A,52B,81C 'self':26B 'self-host':25B 'servic':57B,86C 'swap':44B,76C 'torchserv':2A,28B,30B,56B,65C,85C 'torchserve':17A 'unmaintain':29B 'user':8A,42B,75C 'version':61C","nicknames":[],"mitigations":[],"who_affected":"TorchServe installed with pip (or a plain systemd unit) where TEMP is not set, so models are extracted to /tmp/models, on a machine where other local users or untrusted processes can log in. A local user who creates /tmp/models before TorchServe does can replace the model handler and run code as the TorchServe service account (not root). Can skip: Docker official image (researcher says not affected), PrivateTmp=yes units, TEMP set to a private directory, TorchServe started at boot before any other user exists, single-user hosts, managed hosting.","tier":"B","verified":{"fix":{"at":"2026-11-06T20:45:25Z","by":"analyst","doc":"https://github.com/pytorch/serve","run_id":1931}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["torchserve"],"ptokens":["torchserve"],"labels":["high","localprivilegeescalation","package","python","pytorch","selfhosted","torchserve","unmaintained"],"campaign_type":null,"search_a":"'-123974':13A,16A '-2026':12A,15A '/tmp':4A 'code':10A 'cve':11A,14A 'directori':5A 'let':6A 'local':7A 'predict':3A 'pytorch':1A 'run':9A 'torchserv':2A 'torchserve':17A 'user':8A","search_b":"'/tmp':39B 'account':58B 'archiv':33B 'code':53B 'directori':37B,50B 'escal':21B 'extract':31B 'handler':47B 'host':27B 'local':19B,41B 'local-privilege-escal':18B 'model':32B,46B 'packag':22B 'predict':36B 'privileg':20B 'python':23B 'pytorch':24B 'run':52B 'self':26B 'self-host':25B 'servic':57B 'swap':44B 'torchserv':28B,30B,56B 'unmaintain':29B 'user':42B","search_c":"'/tmp':71C 'account':87C 'code':82C 'directori':69C 'escal':92C 'extract':68C 'handler':79C 'lead':88C 'let':72C 'local':74C,90C 'model':78C 'predict':67C 'privileg':91C 'pytorch':63C 'run':81C 'servic':86C 'swap':76C 'torchserv':65C,85C 'user':75C 'version':61C","first_public_at":"2026-11-06T20:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"7fefd608-56a6-419f-a002-fd8543c0710a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123974","severity":null,"published_at":"2026-11-06T20:17:20+00:00","modified_at":"2026-11-06T20:17:20+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:43:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123974:1931","url":"https://christbowel.com/blog/torchserve-lpe/","severity":null,"published_at":"2026-11-06T20:45:25+00:00","modified_at":"2026-11-06T20:45:25+00:00","first_seen_at":"2026-11-06T20:45:25+00:00","fetched_at":"2026-11-06T20:45:25+00:00","note":"Only a researcher write-up (christbowel, 2026-10-29, coordinated via VulnCheck) exists; no vendor advisory, vendor did not respond. Repo archived, so no fix expected. Researcher says official Docker image not affected; needs TEMP unset and attacker pre-creating /tmp/models. Not root: service account only. Not exploited, no public weaponised PoC (proof handler only). Only fix marked verified (README states no security patches).","cites":["https://christbowel.com/blog/torchserve-lpe/","https://github.com/pytorch/serve"]}],"documents":[{"id":89883,"url":"https://christbowel.com/blog/torchserve-lpe/","title":"TorchServe LPE: a fixed temp path, and a model server that trusts it (christbowel, 2026-10-29)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":89884,"url":"https://github.com/pytorch/serve","title":"pytorch/serve repository (archived, limited maintenance notice)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}