{"action":"Upgrade mlflow to 3.11.0 or later.","affected":[{"fixed":"3.11.0","introduced":"0"}],"component":"mlflow","cve_ids":["CVE-2026-4137"],"ecosystem":"PyPI","epss":0.00193,"exploited":false,"fixed_versions":["3.11.0"],"ghsa_id":"GHSA-f2m9-wcf4-cwwx","id":"tcs_01M5KH0RKNP9FFPWQ6AKCT8GZ0","modified_at":"2026-07-13T16:43:33.416174314Z","published_at":"2026-07-13T15:19:09.106875Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2655","https://nvd.nist.gov/vuln/detail/CVE-2026-4137","https://github.com/mlflow/mlflow/commit/1dcbb0c2fbd1f446c328830e601ca13a28219b8a","https://github.com/advisories/GHSA-4x5p-f36r-mxxr","https://github.com/mlflow/mlflow","https://huntr.com/bounties/648dc30b-76c7-4433-86b8-f43d926fd8d6","https://pypi.org/project/mlflow","https://github.com/advisories/GHSA-f2m9-wcf4-cwwx"],"severity":{"label":"high","score":7},"sources":[{"source":"osv","source_id":"PYSEC-2026-2655","url":"https://osv.dev/vulnerability/PYSEC-2026-2655"}],"summary":"MLFlow Creates a Temporary File With Insecure Permissions"}