A FastAPI authentication bypass allows unauthenticated users to reach routes that are meant to be protected, such as the Job API and the OpenTelemetry trace ingestion API. Because the permission middleware only applies to /gateway/ paths, attackers can submit jobs, view job results, cancel jobs, or inject trace data without providing credentials. This flaw constitutes an authentication weakness (CWE‑305) that can expose sensitive job information and potentially be used to insert arbitrary observability data into experiments.

The vulnerability is present in mlflow 3.9.0 and all earlier releases of the mlflow/mlflow package. The issue was addressed in version 3.10.0; upgrading to that version or later removes the unprotected routes. Applications running older releases with the --app-name basic-auth flag and served via uvicorn are impacted.

The CVSS score of 8.6 indicates a high severity risk. No EPSS data is available at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending HTTP requests to the exposed FastAPI routes such as /ajax-api/3.0/jobs/* and /v1/traces when the mlflow server is configured with authentication enabled and served by uvicorn. The lack of authentication on these endpoints allows unrestricted access from any network source that can reach the server.