Raw vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:LSummary
CVE-2026-2652 is a high-severity Authentication Bypass by Primary Weakness (CWE-305) vulnerability in Lfprojects Mlflow. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Other Platforms; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-8 (Identification and Authentication (Non-organizational Users)) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in MLflow versions 3.9.0 and earlier permits unauthenticated access to selected FastAPI routes when the server is launched with authentication enabled via the --app-name basic-auth flag and served through uvicorn. The FastAPI permission middleware restricts checks to /gateway/ paths only, leaving endpoints such as the Job API at /ajax-api/3.0/jobs/* and the OpenTelemetry trace ingestion route at /v1/traces exposed. The root cause is an architectural mismatch between the original Flask authentication logic and the FastAPI implementation, specifically the failure of _find_fastapi_validator() to cover non-/gateway/ routes.
Unauthenticated remote attackers can therefore submit jobs, retrieve job results, cancel active jobs, and inject arbitrary trace data into experiments without providing credentials. Exploitation requires only network access to a uvicorn-hosted MLflow instance configured for basic authentication and does not depend on any user interaction or special privileges.
The issue is resolved in MLflow 3.10.0. The referenced commit bb62e773263c14e9ba4d1a82fe72d0de2442c6aa restores proper authentication coverage across all FastAPI routes, and the finding was reported through the huntr.com disclosure platform.
EPSS remains low and unchanged at a peak of 0.0132 with no material increase after disclosure. The affected component is the core experiment-tracking server used in many machine-learning workflows.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30499
Vulnerability Data
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes,…
more
leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mlflow
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
V6.4.3V7.2.4
Mitigating Controls (NIST 800-53 r5) AI
Requires unique identification and authentication of users, structurally blocking bypass of the mechanism.
Requires unique identification and authentication of non-organizational users, blocking bypass paths.
Enforces approved authorizations so a bypass weakness cannot be exploited to reach resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices throughout the SDLC prevent the primary weaknesses that enable authentication bypass.
Strong authentication mechanisms and policy enforcement directly reduce bypass opportunities arising from implementation flaws.
Identifying and recording vulnerabilities catches the primary weaknesses that allow authentication bypass.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect authentication bypass conditions before deployment.
Secure development lifecycle reduces likelihood of introducing bypass flaws during implementation.
Secure coding practices help prevent the primary weakness that enables authentication bypass.
Information access restriction complements authentication by limiting what can be reached even if bypass occurs.
Secure authentication mechanisms directly address bypass risks in the implemented authentication process.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-305
Ubuntu 24.04 (1 rule)
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-305