Skip to content
Fencer Vulns
high 8.6

CVE-2026-2652 in the critical feed json

Authentication Bypass in mlflow/mlflow

published 2026-05-15 5 mo ago modified 2026-09-08 2 mo ago also BIT-mlflow-2026-2652 , EUVD-2026-30499 , GHSA-75cm-x2w3-8mgf , PYSEC-2026-2221

cvss
8.6
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
20.8%
EPSS 20.8% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known, plus a Nuclei check

Summary

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.

Patch / fix

  • pypi mlflow 3.10.0, 3.11.0
  • bitnami mlflow 3.10.0
  • mlflow mlflow/mlflow 3.10.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-2652 updated cvss 8.6

mlflow: mlflow: Authentication bypass allows unauthorized job management and data injection

  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-th06-cpu-torch210-py312-rhel9, rhoai/odh-th06-rocm64-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch210-py312-rhel9, rhoai/odh-training-cuda128-torch29-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, +13 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

20.78% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes nuclei detection template
  • huntr.com https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
GitHub 3.0 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
OSV 3.0 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Affected packages

ecosystem package affected fixed in
pypi mlflow
<3.11.0
<3.10.0
3.11.0
3.10.0
bitnami mlflow
<3.10.0
3.10.0

Affected products

  • mlflow mlflow/mlflow

Classification

Weakness
  • CWE-305 Authentication Bypass by Primary Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.