EUVD-2026-18809
GHSA-7qhf-v65m-g5f3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 16 pypi packages depend on mlflow (16 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.10.1.
DescriptionNVD
In mlflow/mlflow, the FastAPI job endpoints under /ajax-api/3.0/jobs/* are not protected by authentication or authorization when the basic-auth app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.
AnalysisAI
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without credentials (CVSS 9.8, CWE-306). Affects mlflow/mlflow latest version when MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true and job functions are allowlisted. Public POC exists per SSVC framework. EPSS score of 0.20% (42nd percentile) indicates low observed exploitation probability despite critical CVSS, suggesting targeted rather than widespread risk. Vendor-released patch not confirmed at time of analysis - remediation relies on configuration changes and service hardening.
Technical ContextAI
MLflow is an open-source platform for managing machine learning lifecycle. The vulnerability resides in the FastAPI job execution endpoints (/ajax-api/3.0/jobs/*) which handle job submission, retrieval, search, and cancellation. When MLflow's basic-auth app is enabled, these endpoints fail to enforce authentication checks (CWE-306: Missing Authentication for Critical Function). The root cause is an authentication enforcement gap in the FastAPI routing layer - while basic-auth protects other MLflow endpoints, job-related routes are inadvertently exposed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable remotely without authentication or user interaction. CPE identifier cpe:2.3:a:mlflow:mlflow/mlflow indicates the core mlflow/mlflow package, affecting installations where job execution features are enabled via MLFLOW_SERVER_ENABLE_JOB_EXECUTION environment variable and at least one job function is allowlisted.
RemediationAI
Primary mitigation (no vendor-released patch confirmed): Disable job execution by setting MLFLOW_SERVER_ENABLE_JOB_EXECUTION=false or removing the environment variable entirely - this eliminates the attack surface but disables job scheduling functionality. If job execution is required, implement network-level access controls: restrict /ajax-api/3.0/jobs/* endpoints to trusted internal networks via firewall rules or reverse proxy ACLs (e.g., nginx location blocks with IP allowlists). Deploy MLflow behind an authenticating reverse proxy (OAuth2, SAML) that enforces authentication before requests reach MLflow. Remove all job functions from allowlists unless absolutely required for operations, reducing RCE attack surface. Monitor job submission logs for unauthorized activity (source IPs, job payloads, execution timestamps). Trade-offs: Disabling job execution may break CI/CD pipelines relying on scheduled model training. Network restrictions may hinder legitimate remote access for data science teams. Workarounds provide defense-in-depth but do not fix the authentication enforcement gap. Consult Huntr disclosure (https://huntr.com/bounties/b2e5b028-9541-4d29-8703-a76f1a3734d8) for technical details and monitor MLflow GitHub repository for official patches.
More in Mlflow Mlflow
View allAuthentication bypass in MLflow 3.9.0 and earlier allows unauthenticated remote attackers to access protected Job API an
Remote unauthenticated attackers can read arbitrary files from MLflow server filesystems in versions 3.9.0 and earlier.
Critical command injection in MLflow 3.8.0 enables remote code execution during model deployment when attackers supply m
Path traversal in MLflow's tar.gz extraction (mlflow/mlflow versions <3.7.0) allows remote attackers to overwrite arbitr
Cross-origin request forgery in MLflow 3.9.0's Assistant feature allows remote attackers to bypass loopback-only protect
MLflow, a popular open-source machine learning lifecycle platform, contains a path traversal vulnerability in its pyfunc
Cross-user artifact overwrite in MLflow versions prior to 3.10.0 allows authenticated users with --serve-artifacts mode
Command injection vulnerability in MLflow versions before v3.7.0 that allows attackers to execute arbitrary commands by
Broken access control in MLflow prior to 3.14.0 lets any authenticated user read, modify, or delete traces belonging to
Command injection in MLflow's MLServer integration allows unauthenticated adjacent network attackers to execute arbitrar
Local privilege escalation to arbitrary code execution in MLflow versions prior to 3.11.0 stems from insecure temporary
Server-side environment variable disclosure in MLflow versions prior to 3.11.0 allows attackers to exfiltrate sensitive
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today