Loading...
Skip to main content
GeekWala

CVE-2026-0545

CRITICAL

mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

Published June 29, 2026Updated July 1, 2026Source: osv

Summary

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.

Affected Packages (1)

PackageEcosystemAffectedFixed In
mlflow
pypi
0.0.1, 0.1.0, 0.2.0, 0.2.1 (+169 more)Range-based data available

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-0545?
mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2026-0545?
CVE-2026-0545 affects mlflow. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-0545 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

PYSEC-2026-419
GHSA-7qhf-v65m-g5f3

Related CVEs

  • CVE-2023-6014
    CRITICAL

    MLflow authentication requirement bypass can allow a user to arbitrarily create an account

  • CVE-2023-6974
    CRITICAL

    MLflow Server-Side Request Forgery (SSRF)

  • CVE-2026-64849
    CRITICAL

    MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

  • CVE-2026-2611
    CRITICAL

    MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

  • CVE-2026-64849
    CRITICAL

    MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

  • CVE-2026-4035
    CRITICAL

    MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration

  • CVE-2026-2635
    CRITICAL

    MLflow Use of Default Password Authentication Bypass Vulnerability

  • CVE-2026-0596
    CRITICAL

    Mlflow: Command Injection when serving models with enable_mlserver=True

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies