MLflow: unauthenticated access to certain FastAPI routes
High8.6CVE-2026-2652 · Published May 15, 2026 · updated Jul 13, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 3.11.0 | 3.11.0 |
Details and references
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-305
- Also known as
- BIT-mlflow-2026-2652, CVE-2026-2652, PYSEC-2026-2221
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 11 | MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem CVE-2026-2614High7.5fixed in 3.10.0 | High7.5 | 3.10.0 |
| May 11 | MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-2393High7.1fixed in 3.9.0 | High7.1 | 3.9.0 |
| May 18 | MLFlow Creates a Temporary File With Insecure Permissions CVE-2026-4137High7.0fixed in 3.11.0 | High7.0 | 3.11.0 |
| May 19 | MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution CVE-2026-2611Critical9.6fixed in 3.10.0 | Critical9.6 | 3.10.0 |
| May 21 | MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks CVE-2026-2734Medium6.5fixed in 3.10.0 | Medium6.5 | 3.10.0 |
| May 26 | MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled CVE-2026-2651Critical9.0fixed in 3.11.0rc1 | Critical9.0 | 3.11.0rc1 |