CVE-2026-2652

MLflow 3.9.0 and earlier, when launched with authentication enabled (--app-name basic-auth) and served via uvicorn (ASGI), fails to enforce authentication on most FastAPI routes because the permission middleware (_find_fastapi_validator()) only covers /gateway/ paths (CWE-305). An unauthenticated remote attacker can therefore submit jobs, read job results, and cancel running jobs through the Job API (/ajax-api/3.0/jobs/*), and can inject arbitrary OpenTelemetry trace data into experiments via /v1/traces. Only deployments that run MLflow with basic-auth enabled over an ASGI (uvicorn) server are affected; servers using the default Flask serving path or running without authentication enabled are not impacted by this bypass. The flaw is fixed in MLflow 3.10.0. No confirmed in-the-wild exploitation is known at this time, but a public proof-of-concept exists and EPSS assigns a ~21% probability of exploitation within 30 days (97th percentile).

What to do: Upgrade to MLflow 3.10.0 or later. In the interim, identify any tracking servers launched with --app-name basic-auth behind uvicorn (ASGI) and restrict network access to /ajax-api/3.0/jobs/* and /v1/traces — for example via an authenticating reverse proxy or firewall rules. Also review job history and experiment traces for signs of unauthenticated job submissions or injected traces.