The vulnerability arises because FastAPI job endpoints under "/ajax-api/3.0/jobs/*" are unprotected when the basic-auth app is enabled. Attackers can submit, read, search, and cancel jobs without credentials, bypassing basic‑auth. If allowed job functions perform privileged actions such as shell execution or filesystem changes, the attacker can achieve unauthenticated remote code execution. Even if jobs are deemed safe, the authentication bypass permits job spam, denial of service, or exposure of job results.

All MLflow installations that enable job execution (MLFLOW_SERVER_ENABLE_JOB_EXECUTION set to true), have basic‑auth enabled, and are running the latest repository version. Because specific version ranges are not supplied, any current release is considered at risk.

The CVSS score of 9.8 classifies the vulnerability as critical. The EPSS score of 11% indicates a relatively high likelihood of exploitation. Even though the vulnerability is not listed in CISA KEV, the risk remains significant. Attackers can use the documented endpoints without credentials, potentially achieving remote code execution or other disruptive activities across the entire system.