---
id: CVE-2026-0545
title: >-
  In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are
  not protected by authentication or authorization when the `basic-auth` app is
  enabled
summary: >-
  In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are
  not protected by authentication or authorization when the `basic-auth` app is
  enabled. This vulnerability affects the latest version of the repository. If
  job e…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: lfprojects
product: mlflow
affected:
  - mlflow
published: '2026-04-03'
updated: '2026-07-21'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0545'
references:
  - url: 'https://huntr.com/bounties/b2e5b028-9541-4d29-8703-a76f1a3734d8'
    label: security@huntr.dev
  - url: 'https://access.redhat.com/security/cve/CVE-2026-0545'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2454889'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0545.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0545'
  - url: 'https://github.com/mlflow/mlflow'
tags:
  - nvd
  - exploit-available
  - osv
  - pip
epss: 0.04392
epssPercentile: 0.90883
ingestedAt: '2026-07-21T19:53:39.758Z'
exploits:
  nuclei:
    - CVE-2026-0545
  checkedAt: '2026-09-24T07:52:56.218Z'
exploitAvailable: true
aliases:
  - GHSA-7qhf-v65m-g5f3
  - PYSEC-2026-419
ecosystem: pip
scores:
  nvd: 9.8
  osv: 9.1
---

## Overview

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.

## Affected

- `mlflow`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-0545)

Affected packages:

- `mlflow <= 3.10.1`

Source: https://osv.dev/vulnerability/GHSA-7qhf-v65m-g5f3