MLflow CVE-2026-2734

Three concrete conditions must be simultaneously true: (1) MLflow is deployed in self-hosted mode with basic HTTP authentication explicitly enabled via the --app-name basic-auth flag or equivalent mlflow.server.auth configuration - default MLflow deployments without auth are unaffected by this specific bypass; (2) the attacker holds at least one valid authenticated user account on the server (CVSS PR:L confirmed); (3) the MLflow version is 3.9.0 or earlier. Exploitation is strictly limited to information disclosure - no write, delete, or availability impact is possible through this vector. The vulnerability does not bypass pre-request authentication, only post-response result filtering, so unauthenticated access remains blocked. Non-default configuration is required: basic auth must be explicitly configured, making this a meaningful limiting factor for risk prioritization.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the threat profile: network-reachable, low complexity, requires one valid credential (PR:L), no user interaction, scoped to confidentiality only. The high confidentiality impact (C:H) is justified because source artifact URIs may reveal internal storage paths (S3 buckets, GCS paths, NFS mounts), and model version tags and descriptions may contain proprietary training data references or business-sensitive details. No KEV listing and no public exploit identified at time of analysis; EPSS data was not provided in the input. Real-world risk is highest in multi-tenant enterprise self-hosted deployments where organizational boundaries between ML teams are enforced via MLflow's permission model - in those environments, any authenticated insider or compromised account effectively nullifies tenant isolation for the model registry. Risk is substantially lower for single-tenant or internal-only deployments where all authenticated users are implicitly trusted. The CVSS score of 6.5 is an appropriate representation; this is not a case of inflated score versus low real-world risk - the gap is deployment-context dependent.

An authenticated low-privilege user - for example, a data scientist granted READ access to only their team's models - issues a GET /ajax-api/2.0/mlflow/model-versions/search request with no model name filter, or submits a mlflowSearchModelVersions GraphQL query. Because no post-response filtering is applied, the server returns metadata for all model versions across every registered model in the instance, including those belonging to other teams. The attacker harvests model names, source artifact URIs (which may point to internal cloud storage paths), version tags, and descriptions, enabling them to map the organization's entire ML model inventory without authorization.