CVE-2026-0545

Missing Authentication for Critical Function in mlflow/mlflow

Published Apr 3, 2026 CVSS 3.1 · 9.8 Critical EPSS 4.4% KEV · Not listed

Description

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.

Analysis

Technical impact

The vulnerability arises because FastAPI job endpoints under "/ajax-api/3.0/jobs/*" are unprotected when the basic-auth app is enabled. Attackers can submit, read, search, and cancel jobs without credentials, bypassing basic-auth. If allowed job functions perform privileged actions such as shell execution or filesystem changes, the attacker can achieve unauthenticated remote code execution. Even if jobs are deemed safe, the authentication bypass permits job spam, denial of service, or exposure of job results.

Affected Systems

All MLflow installations that enable job execution (MLFLOW_SERVER_ENABLE_JOB_EXECUTION set to true), have basic‑auth enabled, and are running the latest repository version. Because specific version ranges are not supplied, any current release is considered at risk.

Risk and Exploitability

The CVSS score of 9.8 classifies the vulnerability as critical. The EPSS score of 4% indicates a relatively low likelihood of exploitation. Even though the vulnerability is not listed in CISA KEV, the risk remains significant. Attackers can use the documented endpoints without credentials, potentially achieving remote code execution or other disruptive activities across the entire system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mlflow

mlflow/mlflow

affected

Version	Status	Constraints
`unspecified`	affected	≤ latest

Configuration 1 [-]

cpe:2.3:a:lfprojects:mlflow:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Mlflow

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Disable job execution by setting MLFLOW_SERVER_ENABLE_JOB_EXECUTION to false
Restrict the job allowlist to only trusted functions, removing any that perform privileged actions
Ensure basic authentication is not simultaneously enabled with job execution unless proper authorization controls are in place

Generated by OpenCVE AI on June 18, 2026 at 04:21 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-7qhf-v65m-g5f3	mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 4.4% (4.392% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://access.redhat.com/errata/RHSA-2026:60520
https://access.redhat.com/security/cve/CVE-2026-0545
https://bugzilla.redhat.com/show_bug.cgi?id=2454889
https://huntr.com/bounties/b2e5b028-9541-4d29-8703-a76f1a3734d8
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0545.json

History

Aug 28, 2026 4:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:60520

Apr 21, 2026 2:00 AM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Lfprojects Lfprojects mlflow
CPEs		cpe:2.3:a:lfprojects:mlflow:-:::::::*
Vendors & Products		Lfprojects Lfprojects mlflow
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Apr 3, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mlflow Mlflow mlflow
Vendors & Products		Mlflow Mlflow mlflow

Apr 3, 2026 7:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 3, 2026 5:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.
Title		Missing Authentication for Critical Function in mlflow/mlflow
Weaknesses		CWE-306
References		https://huntr.com/bounties/b2e5b028-9541-4d29-8703-a76f1a3734d8
Metrics		cvssV3_0 `{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`