What is the CVSS score of CVE-2026-2635?

CVE-2026-2635 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 1.4%.

How to fix or mitigate CVE-2026-2635?

24 hours: Inventory all MLflow deployments; identify instances running with built-in basic authentication enabled. 7 days: Apply vendor-released patch to all affected installations and immediately rotate administrator credentials. 30 days: Migrate authentication to enterprise identity systems (LDAP, SAML, OAuth) to eliminate file-based credential dependency.

CVE-2026-2635

HIGH

Use of Default Password (CWE-1393)

2026-02-20 zdi-disclosures@trendmicro.com

GHSA-gq3w-7jj3-x7gr

Authentication Bypass RCE

7.3

CVSS 3.1 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

9.8 CRITICAL

Default credentials require no auth (PR:N) and are network-exploitable at low complexity; described arbitrary code execution as administrator justifies High C/I/A rather than NVD's Low impacts.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:28 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:27 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:26 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:25 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:23 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 03:23 NVD

CRITICAL HIGH

CVSS changed

Jun 30, 2026 - 03:23 NVD

9.8 (CRITICAL) 7.3 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 23:16 nvd

CRITICAL 9.8

DescriptionCVE.org

MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.

AnalysisAI

Authentication bypass leading to administrator-level remote code execution affects MLflow installations that use the built-in basic authentication, which ships a basic_auth.ini file containing hard-coded default credentials. Remote unauthenticated attackers who know these well-known defaults can log in as the administrator and execute arbitrary code in that context. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the EPSS score of 1.39% (80th percentile) reflects above-average exploitation interest for a Trend Micro ZDI-disclosed flaw with an available vendor patch.