CVE-2026-2652

Katalog CVE

CVSS 8.6 · High EPSS 1,4%

Kerentanan Authentication Bypass by Primary Weakness pada lfprojects mlflow. Skor CVSS 3.0 8.6 (High) menurut huntr.dev.

Deskripsi (NVD)

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.

Rincian

Terbit di NVD

15 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

8.6 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-305: Authentication Bypass by Primary Weakness

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa patch
• https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756 exploit · mitigasi · advisory pihak ketiga