TorchServe: predictable /tmp extraction path lets a local user swap a model handler and run code as the service account

Impact

TorchServe extracts model archives to a predictable directory under /tmp, so any local user on the node can pre-create or replace the extracted model handler before TorchServe loads it. The handler then executes as the TorchServe service account, which on an inference node typically holds the GPU device files, the model store and whatever credentials the serving process uses to pull models. On a shared GPU node - a bastion or build host where more than one person has a shell, or a container that shares /tmp with the serving process - this is a straight path from unprivileged local access to control of the inference service and the models it serves. Reported as affecting all versions, with no fixed release named in the record.

Who can reach it

Local unprivileged user with write access to the /tmp filesystem used by the TorchServe process. No authentication to TorchServe itself is needed; the attacker never touches its management or inference API.

What to do

No fixed version is named in the record. Mitigate: give TorchServe a private temporary directory (per-service PrivateTmp or an explicit TMPDIR on a directory only the service account can write), stop sharing /tmp between TorchServe and any other workload, and remove interactive local accounts from inference nodes. Applying a TMPDIR or PrivateTmp change means restarting the TorchServe daemon, which drops in-flight inference requests but does not require draining or rebooting the node.

References

Related entries

• Keras (`TorchModuleWrapper`): Unsafe deserialization of attacker-controlled PyTorch pickle inside a Keras modelCVE-2026-12484 · Keras (`TorchModuleWrapper`)High
• timm: untrusted checkpoint deserialization executes arbitrary code in the loading processCVE-2026-15679 · Hugging Face pytorch-image-models (timm) checkpoint loadingHigh
• HuggingFace transformers (`Trainer._load_rng_state`): Arbitrary code execution when a training run resumesCVE-2026-1839 · HuggingFace transformers (`Trainer._load_rng_state`)High
• NVIDIA NeMo Speech: malicious input data leads to remote code executionCVE-2026-24239 · NVIDIA NeMo SpeechHigh
• NVIDIA NeMo Speech: RCE and privilege escalation in the speech data explorerCVE-2026-24267 · NVIDIA NeMo Speech (speech data explorer)High
• BentoML (`safe_extract_tarfile`): Tar extraction escape despite the "safe" helperCVE-2026-27905 · BentoML (`safe_extract_tarfile`)High