{"id":"CVE-2026-2652","published":"2026-05-15T02:13:19Z","modified":"2026-05-15T13:22:21Z","title":"Authentication Bypass in mlflow/mlflow","vendor":"mlflow","product":"mlflow/mlflow","tier":"core","eol":null,"affectedVersions":[{"vendor":"mlflow","product":"mlflow/mlflow","versions":[">= unspecified, < 3.10.0"]}],"description":{"text":"A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an authentication bypass in the mlflow/mlflow product, specifically in its FastAPI permission middleware, which only enforces authentication on /gateway/ routes when the server runs with --app-name basic-auth under uvicorn. An unauthenticated remote attacker with network access can reach unprotected routes such as the Job API and the OpenTelemetry trace ingestion API to submit, read, and cancel jobs and inject arbitrary trace data into experiments, without needing credentials or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:54:04Z"},"cvss":{"score":8.6,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.20783,"percentile":0.97539,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-07","exploitedFirstSeen":"2026-08-07","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-07&host_type=src&vulnerability=cve-2026-2652","date":"2026-08-07"},{"url":"https://previdian.com/CVE-2026-2652","date":"2026-08-07"},{"url":"https://www.crowdsec.net/vulntracking-report/cve-2026-2652-mlflow-authentication-bypass","date":"2026-08-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-14&host_type=src&vulnerability=cve-2026-2652","date":"2026-08-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-15&host_type=src&vulnerability=cve-2026-2652","date":"2026-08-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-17&host_type=src&vulnerability=cve-2026-2652","date":"2026-08-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-19&host_type=src&vulnerability=cve-2026-2652","date":"2026-08-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-20&host_type=src&vulnerability=cve-2026-2652","date":"2026-08-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-22&host_type=src&vulnerability=cve-2026-2652","date":"2026-08-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-24&host_type=src&vulnerability=cve-2026-2652","date":"2026-08-24"}],"evidenceTotal":59,"provenance":"source"},"exploited":true,"otx":{"pulseCount":7,"pulses":[{"name":"Known_Cve | May 23, 2026","url":"https://otx.alienvault.com/pulse/6a10657811ce8e8449e3af12","created":"2026-05-22"},{"name":"Known_Cve | May 22, 2026","url":"https://otx.alienvault.com/pulse/6a0f13fd08d4602f56683eec","created":"2026-05-21"},{"name":"Known_Cve | May 21, 2026","url":"https://otx.alienvault.com/pulse/6a0dc2491bcde0bdb3d7e14e","created":"2026-05-20"},{"name":"Known_Cve | May 20, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a0c70e0012db9b5d3f1491b","created":"2026-05-19"},{"name":"Known_Cve | May 19, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a0b1fb13f83c21729d9156a","created":"2026-05-18"},{"name":"Known_Cve | May 18, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a09cd588d4c1cca2886f0d1","created":"2026-05-17"},{"name":"Known_Cve | May 17, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6a087be2825364446566d8c0","created":"2026-05-16"}],"provenance":"machine"},"cwes":[{"id":"CWE-305","name":"Authentication Bypass by Primary Weakness"}],"references":[{"url":"https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756","tags":[]},{"url":"https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"mlflow","vulnerableRanges":["<3.11.0","<3.10.0"],"patched":["3.11.0","3.10.0"],"from":["GHSA-75cm-x2w3-8mgf","PYSEC-2026-2221"],"provenance":"source"}],"advisories":[{"id":"GHSA-75cm-x2w3-8mgf","url":"https://github.com/advisories/GHSA-75cm-x2w3-8mgf","severity":"HIGH","ecosystem":"PyPI","package":"mlflow","vulnerableRanges":["<3.11.0"],"patched":["3.11.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-30499","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30499","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2026-2652","name":"MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes","severity":"high","path":"http/cves/2026/CVE-2026-2652.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-2652.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-05-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-2652","provenance":"source"},{"date":"2026-08-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-07&host_type=src&vulnerability=cve-2026-2652","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":77.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 85 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.51,"detail":"percentile 0.9754"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":6.02,"detail":"base score 8.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}