mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization
Critical9.1CVE-2026-0545 · Published Apr 3, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | <= 3.10.1 | No fix yet |
Details and references
In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-306
- Also known as
- CVE-2026-0545, PYSEC-2026-419
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 31 | Mlflow: Command Injection when serving models with enable_mlserver=True CVE-2026-0596Critical9.6fixed in 3.9.0 | Critical9.6 | 3.9.0 |
| Mar 30 | MLflow Command Injection vulnerability CVE-2025-15379Critical10.0fixed in 3.8.1 | Critical10.0 | 3.8.1 |
| Mar 30 | MLFlow path traversal vulnerability CVE-2025-15036Critical9.6fixed in 3.9.0rc0 | Critical9.6 | 3.9.0rc0 |
| Apr 7 | MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint CVE-2026-33866Medium4.3fixed in 3.11.0rc0 | Medium4.3 | 3.11.0rc0 |
| Apr 7 | MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface CVE-2026-33865Medium5.4fixed in 3.11.1 | Medium5.4 | 3.11.1 |
| Mar 27 | MLFlow allows Tracing + Assessments Access CVE-2025-15381High8.1no fix yet | High8.1 | No fix yet |