GitHub Advisoryadvisory · PyPI
GHSA-gq3w-7jj3-x7gr MLflow Use of Default Password Authentication Bypass Vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2026-2635
- Ecosystem
- PyPI
- Packages
- mlflow
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1393
- Reviewed
- 2026-03-17
Affected packages
• PyPI mlflow: < 3.8.0rc0 → fixed in 3.8.0rc0
Description
This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator.
Related
Alias · CVE (1)
- CVE-2026-2635 MLflow Use of Default Password Authentication Bypass Vulnerability. vulnerability
Weakness · CWE (1)
- CWE-1393 Use of Default Password weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-2635 advisory
- https://github.com/mlflow/mlflow/pull/19260 web
- https://github.com/mlflow/mlflow/commit/5bf2ec2bd4222a18d78631183ac7f6b752afe8a4 web
- https://github.com/mlflow/mlflow package
- https://github.com/mlflow/mlflow/releases/tag/v3.8.0rc0 web
- https://www.zerodayinitiative.com/advisories/ZDI-26-111 web