CVE-2026-123974

Full vulnerability record from the local CVENow database.

Description

In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Received

Source identifier

7fefd608-56a6-419f-a002-fd8543c0710a

Published

2026-11-06 20:17:20.633000

Last modified

2026-11-06 20:17:20.633000

View original CVE JSON

{
  "id": "CVE-2026-123974",
  "sourceIdentifier": "7fefd608-56a6-419f-a002-fd8543c0710a",
  "published": "2026-11-06T20:17:20.633",
  "lastModified": "2026-11-06T20:17:20.633",
  "vulnStatus": "Received",
  "cveTags": [
    {
      "sourceIdentifier": "7fefd608-56a6-419f-a002-fd8543c0710a",
      "tags": [
        "unsupported-when-assigned"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation."
    }
  ],
  "affected": [
    {
      "source": "7fefd608-56a6-419f-a002-fd8543c0710a",
      "affectedData": [
        {
          "vendor": "PyTorch",
          "product": "TorchServe",
          "defaultStatus": "unknown",
          "repo": "https://github.com/pytorch/serve",
          "versions": [
            {
              "version": "0",
              "lessThan": "*",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "7fefd608-56a6-419f-a002-fd8543c0710a",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "7fefd608-56a6-419f-a002-fd8543c0710a",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-379"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://christbowel.com/blog/torchserve-lpe/",
      "source": "7fefd608-56a6-419f-a002-fd8543c0710a"
    },
    {
      "url": "https://github.com/Christbowel/torchserve-lpe",
      "source": "7fefd608-56a6-419f-a002-fd8543c0710a"
    }
  ]
}