CVE-2026-0545: MLflow's basic-auth Only Gated Flask

An analysis of CVE-2026-0545 has been published — an authentication bypass in MLflow that emerged during the server's migration from Flask to FastAPI. When Basic Auth was enabled, some APIs remained accessible without credentials.

MLflow uses a hybrid architecture: several native routes are handled directly by FastAPI, while the entire Flask application is mounted at / via WSGI. The two authentication gates have opposite defaults: Flask → deny by default FastAPI → allow by default The FastAPI middleware checked only routes for which a validator had been registered. If no validator was found, the request was simply forwarded without authentication. As a result, three of the four FastAPI routers were publicly accessible without authentication: /v1/traces /ajax-api/3.0/jobs /ajax-api/3.0/mlflow/assistant

CVE-2026-0545 CVE-2026-0545 covers the authentication bypass on POST /ajax-api/3.0/jobs/. The endpoint allows clients to launch jobs registered on the server and pass parameters to them. An arbitrary function cannot be selected — the available jobs are limited to an internal list of supported functions. However, an unauthenticated attacker could launch any registered job with attacker-controlled parameters. The impact depends on the registered functions: from running judge-LLM jobs against the operator's billing account to potential remote code execution. Exploitation requires the job runner to be enabled through MLFLOW_SERVER_ENABLE_JOB_EXECUTION.

The patch fixed the vulnerability, but not the underlying architectural issue The fix added the three missing FastAPI prefixes to the validator lookup: /jobs and /assistant now require authentication, while /v1/traces received a separate authorization check. The author calls this class of bugs a Parallel Implementation Gap: a single security policy is implemented independently across multiple components, and their behavior diverges over time. In MLflow, the list of FastAPI routers and the list of validators protecting them are located in different files and must be kept synchronized manually. The architectural risk therefore remains: Flask requires authentication by default, while FastAPI forwards unmatched routes without authentication. A new router for which a developer forgets to register a validator could once again end up publicly accessible without authentication.

PoC (Nuclei template): https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-0545.yaml

Article: https://nefariousplan.com/posts/mlflow-basic-auth-only-gated-flask