CVE-2026-2652High· 8.6▾ MidnightPoC availableMLflow: unauthenticated access to certain FastAPI routes
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.3 · likelihood 4.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.5%
1.5% → 21%
Nuclei ×1
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (--app-name basic-auth) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on /gateway/ routes, leaving other routes such as the Job API (/ajax-api/3.0/jobs/*) and the OpenTelemetry trace ingestion API (/v1/traces) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the _find_fastapi_validator() function fails to handle non-/gateway/ paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.
mlflow < 3.11.0Upgrade to a patched release:
mlflow 3.11.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-71211High· 7.1MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim
CVE-2026-0545Critical· 9.8In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled
CVE-2023-43472High· 7.5Information exposure in MLflow
CVE-2023-6977High· 7.5MLflow Local File Disclosure Vulnerability
CVE-2024-37054High· 8.8MLFlow unsafe deserialization
CVE-2024-1483High· 7.5mlflow Path Traversal vulnerability