CVE-2026-123974

TorchServe model extraction permits local privilege escalation

PyTorch · PyTorch TorchServe

First documented disclosure · Review checkpoint

Summary

A shared model-extraction directory enables local privilege escalation.

Severity and exploitation evidence

High · 7.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reporting researcher demonstrated local escalation; CISA enrichment labels exploitation as proof of concept. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

TorchServe can reuse a shared extraction location without verifying that the service account controls it.

Conditions required

A local account must be able to influence the shared temporary directory on a TorchServe host.

Potential impact

A model handler can be replaced and code can run as the serving account.

Affected versions and configurations

All releases per CNA.

Fix and mitigation status

No fixed release. The project is archived.

Practical next steps

Use a private temporary directory owned by the service account or a private service namespace. Plan migration from archived TorchServe.

Operating lesson

Keep temporary model files in a location controlled exclusively by the serving process.

Evidence and limits

The original October 29 account and CNA agree that TorchServe is archived. The CNA lists defensive configuration changes and does not identify a patched release.

Sources