Description

In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-11-06T20:17:20.633Z",
  "pubdate": "2026-11-06T20:17:20.633Z",
  "executiveSummary": "This vulnerability involves a predictable temporary directory creation process within TorchServe, which facilitates local privilege escalation. All versions of TorchServe are currently identified as affected by this design flaw. The vulnerability stems from insecure handling of model extraction processes in the /tmp directory, which lacks sufficient entropy or restrictive permissions. An attacker with local access to the underlying host system can exploit this predictability to perform a symlink or file-replacement attack. By successfully swapping the authorized model handler with a malicious payload, an unauthorized user can execute arbitrary code under the security context of the TorchServe service account. The risk implication is significant, as it permits lateral movement and privilege escalation from a standard local user to the service's operating permissions, potentially compromising the integrity and confidentiality of the model server and any data it processes.",
  "technicalDetails": "The core of the vulnerability resides in the way TorchServe manages the extraction of model artifacts. During the initialization or loading phase, TorchServe utilizes a predictable path within the /tmp filesystem to unpack model handler files. Because the naming convention or the location of this directory is deterministic and lacks cryptographically secure randomness, an unprivileged local attacker can pre-emptively create the directory structure or monitor for its creation.\nThe exploitation flow follows a race condition or a pre-emptive filesystem manipulation pattern. An attacker anticipates the directory path TorchServe will utilize for model handler extraction. Prior to the service unpacking the model, the attacker creates a symbolic link or directly populates the predictable location with a maliciously crafted handler file. When TorchServe initializes, it unintentionally loads the attacker-supplied handler instead of the legitimate, intended model logic.\nBecause the TorchServe service process typically runs with elevated privileges—or simply with the privileges of the dedicated service account—the execution of the malicious handler occurs within that same context. This constitutes a classic file-replacement attack leading to arbitrary code execution (ACE). The attacker requires local access to the system hosting the TorchServe instance, but does not require authentication to the TorchServe application itself, as the exploit is performed at the OS filesystem level.\nThe vulnerable component is the file extraction and model deployment routine responsible for staging model artifacts on the local disk. The lack of validation regarding the ownership and permissions of the extraction destination allows an attacker to intercept the lifecycle of the model deployment process. Once the malicious code is executed, the attacker gains the effective permissions of the TorchServe service account, allowing for persistent access, modification of models, or further exploitation of the host environment."
}