What is the CVSS score of CVE-2026-2652?

CVE-2026-2652 has a CVSS 3.0 base score of 8.6 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of MLflow are affected by CVE-2026-2652?

MLflow versions 3.9.0 and earlier contain an authentication bypass vulnerability (CVE-2026-2652, CVSS 8.6) that allows unauthenticated attackers to submit jobs, access job results, and inject…. A patch is available.

Is there a public PoC exploit available for CVE-2026-2652?

Yes, a public proof-of-concept exploit is available for CVE-2026-2652. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-2652?

Within 24 hours: inventory all MLflow deployments and confirm versions affected (3.9.0 and earlier); document which instances have basic-auth enabled via uvicorn/ASGI. Within 7 days: apply vendor-released patch to MLflow version 3.10.0 or later (GitHub commit bb62e77 or later). Within 30 days: conduct audit of Job API and /v1/traces endpoint access logs to identify unauthorized submissions or data injection; validate authentication enforcement across all FastAPI routes post-patch.

MLflow CVE-2026-2652

EUVD-2026-30499 HIGH

Authentication Bypass by Primary Weakness (CWE-305)

2026-05-15 @huntr_ai

GHSA-75cm-x2w3-8mgf

Authentication Bypass Python

8.6

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

May 15, 2026 - 04:16 EUVD

Source Code Evidence Fetched

May 15, 2026 - 03:31 vuln.today

Analysis Generated

May 15, 2026 - 03:31 vuln.today

CVE Published

May 15, 2026 - 02:13 nvd

HIGH 8.6

DescriptionCVE.org

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (--app-name basic-auth) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on /gateway/ routes, leaving other routes such as the Job API (/ajax-api/3.0/jobs/*) and the OpenTelemetry trace ingestion API (/v1/traces) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the _find_fastapi_validator() function fails to handle non-/gateway/ paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.

AnalysisAI

Authentication bypass in MLflow 3.9.0 and earlier allows unauthenticated remote attackers to access protected Job API and OpenTelemetry trace ingestion endpoints when the server runs with basic-auth enabled via uvicorn/ASGI. Attackers can submit jobs, read results, cancel operations, and inject trace data without credentials. The FastAPI permission middleware incorrectly enforced authentication only on /gateway/ routes, leaving /ajax-api/3.0/jobs/* and /v1/traces unprotected due to architectural mismatch between Flask and FastAPI authentication mechanisms. Fixed in version 3.10.0 with GitHub commit bb62e77 adding proper validators for all FastAPI routes.

Technical ContextAI

MLflow is a machine learning lifecycle platform that combines Flask (WSGI) and FastAPI (ASGI) frameworks. The vulnerability stems from CWE-305 (Authentication Bypass by Primary Weakness) in the authentication middleware layer. When MLflow server starts with --app-name basic-auth and serves via uvicorn, the _find_fastapi_validator() function was designed to return route-specific authorization validators but only handled /gateway/ prefixed paths. The Job API (/ajax-api/3.0/jobs/*), MLflow Assistant API (/ajax-api/3.0/mlflow/assistant), and OpenTelemetry trace ingestion endpoints (/v1/traces) existed in the FastAPI routing layer but lacked corresponding validators, causing the middleware to skip authentication entirely for these routes. The architectural gap between Flask's authentication model and FastAPI's dependency injection system created this security hole where FastAPI routes inherited no default authentication requirement.

RemediationAI

Upgrade to MLflow version 3.10.0 or later, which adds proper authentication validators for all FastAPI routes via commit bb62e773263c14e9ba4d1a82fe72d0de2442c6aa. The fix implements _get_require_authentication_validator() for Job and Assistant APIs (enforces authentication without additional permission checks) and _get_otel_validator() for trace ingestion (validates X-Mlflow-Experiment-Id header and enforces experiment-level UPDATE permissions). If immediate upgrade is not feasible, implement network-level access controls to restrict /ajax-api/3.0/jobs/*, /ajax-api/3.0/mlflow/assistant/*, and /v1/traces endpoints to trusted internal networks only using firewall rules or reverse proxy URL filtering - note this prevents legitimate remote API usage and breaks distributed ML workflows. Alternatively, deploy MLflow without authentication (--app-name basic-auth disabled) if operating in a trusted network perimeter, accepting the trade-off of no application-layer access control. Audit logs for unauthorized access to affected endpoints between deployment date and patch application, searching for POST/GET requests to /ajax-api/3.0/jobs/* and /v1/traces from unexpected source IPs or without Authorization headers. Review https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa for complete technical details.