---
id: "CVE-2026-123974"
page: "https://infrastack.ai/live/CVE-2026-123974"
kind: "vulnerability"
aliases: ["CVE-2026-123974"]
title: "PyTorch TorchServe: predictable /tmp directory lets local user run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "torchserve", "fixed": [], "affected": "all versions (reproduced on 0.12.0, the last release)", "ecosystem": "pypi"}]
ecosystems: []
tags: ["local-privilege-escalation", "package", "python", "pytorch", "self-hosted", "torchserve", "unmaintained"]
not_affected_if: ["docker-official-image", "managed-hosting", "private-tmp", "single-user-host", "temp-dir-set"]
published_at: "2026-11-06T20:17:20+00:00"
first_seen_at: "2026-11-06T20:43:59+00:00"
updated_at: "2026-11-06T20:45:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123974", "first_seen_at": "2026-11-06T20:43:59+00:00"}, {"source": "analyst", "url": "https://github.com/pytorch/serve", "first_seen_at": "2026-11-06T20:45:25+00:00", "cites": ["https://github.com/pytorch/serve", "https://christbowel.com/blog/torchserve-lpe/"]}]
exploit_sources: []
---

# PyTorch TorchServe: predictable /tmp directory lets local user run code

Link for people: https://infrastack.ai/live/CVE-2026-123974 (this .md is for agents)

TorchServe extracts model archives into a predictable directory under /tmp. A local user can swap the model handler in that directory and run code as the TorchServe service account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:torchserve affected all versions (reproduced on 0.12.0, the last release) fixed no fixed version listed

## How to check

- Run `pip show torchserve`; the researcher reproduced this on 0.12.0 (last release), NVD says all versions.
- Check whether the TEMP environment variable is set for the TorchServe process; if unset, models extract to /tmp/models.
- Run `ls -ld /tmp/models`: if it exists and is owned by a user other than the TorchServe service account, treat it as hostile and remove it.
- If TorchServe runs under systemd, check the unit for PrivateTmp=yes (this blocks the attack).
- Also check if you start TorchServe by hand while other users are logged in, or run a /tmp cleaner.

## Fix

No fix: the pytorch/serve repository is archived and its README says no security patches are planned. Workaround from the researcher (not the vendor): set TEMP (or -Djava.io.tmpdir) to a directory owned by the service account and not world-writable, or add PrivateTmp=yes to the systemd unit.

## Timeline

- 2026-11-06T20:43:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123974
- 2026-11-06T20:45:25+00:00 analyst https://github.com/pytorch/serve — Only a researcher write-up (christbowel, 2026-10-29, coordinated via VulnCheck) exists; no vendor advisory, vendor did not respond. Repo archived, so no fix expected. Researcher says official Docker image not affected; needs TEMP unset and attacker pre-creating /tmp/models. Not root: service account only. Not exploited, no public weaponised PoC (proof handler only). Only fix marked verified (README states no security patches).

## Documents

- [advisory] pytorch/serve repository (archived, limited maintenance notice) https://github.com/pytorch/serve
- [describes] TorchServe LPE: a fixed temp path, and a model server that trusts it (christbowel, 2026-10-29) https://christbowel.com/blog/torchserve-lpe/

## From the sources

In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_