MLflow CVE-2026-2652

Requires MLflow server version 3.9.0 or earlier started with --app-name basic-auth flag (authentication explicitly enabled) AND served via uvicorn ASGI server. Network-accessible deployment (typically listening on port 5000 or behind reverse proxy) where FastAPI-routed endpoints are reachable. Default MLflow installations without --app-name basic-auth are not vulnerable as no authentication bypass occurs when authentication is not configured. Flask-only deployments (without FastAPI routes) are not affected. The vulnerability is specific to the architectural combination of enabled authentication plus ASGI/FastAPI serving mode where the _find_fastapi_validator() function exists but returns None for non-gateway routes.

High real-world risk despite absence of EPSS/KEV data. CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) accurately reflects the severity - remote unauthenticated exploitation against network-accessible MLflow deployments with no attack complexity. The vulnerability affects organizations that explicitly enabled authentication (--app-name basic-auth), believing their deployment was secured, creating a false sense of security. Impact includes medium confidentiality breach (reading job results), high integrity compromise (submitting/canceling jobs, injecting trace data into experiments), and low availability impact (job cancellation). The presence of a vendor-released patch (3.10.0) with detailed commit evidence and comprehensive test coverage confirms both the vulnerability's validity and remediability. MLflow's role in ML ops pipelines means this could expose proprietary model training data, experiment parameters, and potentially provide lateral movement opportunities in data science infrastructure. No public exploit code identified but the commit diff provides complete implementation details making weaponization trivial for skilled attackers.

An external attacker scans for MLflow servers on port 5000 (default) and identifies a deployment with authentication enabled via 401 responses on Flask routes. Testing /ajax-api/3.0/jobs/search with a POST request bypasses authentication and returns active ML training jobs. The attacker submits a malicious job via /ajax-api/3.0/jobs/create that exfiltrates model training data to an external endpoint, reads proprietary hyperparameter configurations from existing jobs, cancels a critical production model training pipeline causing operational disruption, and injects false trace data via /v1/traces to pollute experiment tracking and corrupt model provenance records. No authentication credentials required for complete compromise of Job API and telemetry ingestion functions.