CVE-2026-2652

Name of the Vulnerable Software and Affected Versions mlflow versions prior to 3.10.0

Description An authentication bypass occurs when the server is started with authentication enabled via --app-name basic-auth and served using uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on '/gateway/' routes, leaving other endpoints unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue is caused by an architectural mismatch between Flask and FastAPI authentication mechanisms, specifically where the find fastapi validator() function fails to handle non-'/gateway/' paths. Affected endpoints include the Job API '/ajax-api/3.0/jobs/*' and the OpenTelemetry trace ingestion API '/v1/traces'. Over 9,700 potentially affected devices have been identified.

Recommendations Update to version 3.10.0.