GHSA-gq3w-7jj3-x7gr CVE-2026-2635 PYSEC-2026-421
MLflow Use of Default Password Authentication Bypass Vulnerability
- Severity
- 9.8 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 1.08%
- Chance of exploitation in the next 30 days. Higher than 65.02% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1393 Use of Default Password
- Fix
3.8.0rc0- Upgrade mlflow to this version or later
Description
This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| mlflow | < 3.8.0rc0 |
3.8.0rc0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
mlflow PyPI → 3.8.0rc0
- pip
pip install --upgrade "mlflow>=3.8.0rc0"- poetry
poetry add "mlflow>=3.8.0rc0"- uv
uv add "mlflow>=3.8.0rc0"
Severity breakdown
CVSS 3.0 9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-1393: Use of Default Password
The product uses default passwords for potentially critical functionality.
How to prevent it
- Requirements: Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
- Documentation: Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.
- Architecture and Design: Force the administrator to change the credential upon installation.
- Installation, Operation: The product administrator could change the defaults upon installation or during operation.
References
Advisories
Packages
Other links
- github.com/mlflow/mlflow/pull/19260
- github.com/mlflow/mlflow/commit/5bf2ec2bd4222a18d78631183ac7f6b752afe8a4
- github.com/mlflow/mlflow/releases/tag/v3.8.0rc0
- zerodayinitiative.com/advisories/ZDI-26-111
- zerodayinitiative.com/advisories/ZDI-26-111
- access.redhat.com/security/cve/CVE-2026-2635
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2635.json
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7gwp-5pfp-969j MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | Critical Known exploited | Also affects mlflow |
| GHSA-26p8-2jq9-3vq9 MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules | Critical | Also affects mlflow |
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Also affects mlflow |
| GHSA-m65p-9j7q-6w33 MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source | High | Also affects mlflow |
| GHSA-2wqp-q3c6-ccj5 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints | Medium | Also affects mlflow |
| GHSA-wqmh-qccw-pqwf MLflow FileStore trace IDs allow path traversal and arbitrary file writes | High | Also affects mlflow |
| GHSA-gqvg-gmmx-x4hm MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact | High | Also affects mlflow |
| GHSA-h7x2-h6g9-p789 MLflow AI Gateway permits SSRF through an unvalidated api_base | High | Also affects mlflow |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor