CVE-2022-0736: Insecure Temporary File in mlflow
Summary
CVE-2022-0736: Insecure Temporary File in mlflow. Affects mlflow versions < 1.23.1. Fixed in 1.23.1. How to fix ↓
Also tracked for
- mlflow · Bitnami
The same CVE-2022-0736 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mlflow is a Python package that provides a platform for managing and tracking machine learning experiments. It allows users to log and query experiments, package and deploy models, and collaborate on projects. The package is widely used in the Python ecosystem for machine learning workflows. However, prior to version 1.23.1, mlflow contains an insecure temporary file vulnerability. The deprecated function tempfile.mktemp() is used instead of the recommended mkstemp(), which can lead to security issues.
Vulnerability Detail
The insecure temporary file vulnerability in mlflow can be exploited by an attacker to gain unauthorized access to sensitive information or execute arbitrary code. By using the deprecated tempfile.mktemp() function, temporary files are created in a predictable manner, making it easier for an attacker to guess the file name and manipulate it. This can result in various security risks, such as information disclosure, privilege escalation, or denial of service attacks. The vulnerability has a CVSS score of 8.2, indicating a high severity level.
How To Fix
Latest published version: 3.17.2 as of 23 Oct 2026
pip install --upgrade "mlflow==3.17.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.23.1
This is the first release that contains the fix.
pip install --upgrade "mlflow==1.23.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround can be implemented by manually replacing the deprecated tempfile.mktemp() function with mkstemp() in the affected code. Here is an example of how the code can be modified:
import tempfile
# Replace insecure tempfile.mktemp() with mkstemp()
file_path = tempfile.mkstemp()
Conclusion
In conclusion, the insecure temporary file vulnerability in mlflow can pose significant security risks. It is crucial to upgrade to mlflow version 1.23.1 or later to mitigate this vulnerability. If immediate upgrade is not possible, implementing the provided workaround can help reduce the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mlflow →
FAQ
mlflow is a Python package used for managing and tracking machine learning experiments. It provides functionalities for logging and querying experiments, packaging and deploying models, and collaborating on projects.
The insecure temporary file vulnerability in mlflow can allow an attacker to gain unauthorized access to sensitive information or execute arbitrary code. This can lead to various security risks, such as information disclosure, privilege escalation, or denial of service attacks.
To fix this vulnerability, it is recommended to upgrade to mlflow version 1.23.1 or later. This version replaces the insecure tempfile.mktemp() function with the secure mkstemp() function.
If upgrading to the latest version is not immediately possible, a temporary workaround can be implemented by manually replacing the deprecated tempfile.mktemp() function with mkstemp() in the affected code. Please refer to the provided code example for guidance.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mlflow.
