A vulnerability in mlflow/mlflow versions 3.9.0 and earlier

CVE-2026-2652 is an authentication bypass in MLflow versions prior to 3.11.0 (originally reported against ≤3.9.0). When the server is launched with --app-name basic-auth and served via uvicorn (ASGI), the FastAPI permission middleware only enforces authentication on /gateway/ routes. The Job API (/ajax-api/3.0/jobs/*) and the OpenTelemetry trace ingestion API (/v1/traces) are left completely unprotected. An unauthenticated remote attacker can submit arbitrary jobs, read job results, cancel running jobs, and inject trace data into experiments. The root cause is an architectural mismatch in _find_fastapi_validator() between Flask and FastAPI auth handling — it simply does not validate non-gateway paths.

The vendor scored this 8.6 HIGH, which is directionally correct but slightly generous. The CVSS vector (AV:N/AC:L/PR:N/UI:N) accurately reflects the zero-interaction, unauthenticated remote attack surface. However, the vendor score does not account for the configuration prerequisites: the target must be running with --app-name basic-auth AND served specifically via uvicorn ASGI — not the default gunicorn/WSGI configuration. MLflow instances with no auth at all (a disturbingly common posture) are not *more* vulnerable via this CVE; they're already wide open through other means. This narrows the actually-affected population. That said, the ML supply-chain implications of arbitrary job submission on a model training platform keep this firmly in HIGH territory.

Why this verdict

• Configuration prerequisites narrow the population: The target must run with --app-name basic-auth AND uvicorn ASGI — not the default gunicorn/WSGI setup. This eliminates a significant fraction of deployments. Instances with no auth at all are not additionally vulnerable via this CVE.
• No auth required for exploitation: Once a qualifying instance is found, the attack is trivially simple — a single unauthenticated HTTP request. No PoC is needed; curl suffices. The CVSS vector correctly reflects PR:N/UI:N.
• EPSS at 97th percentile signals high predicted exploitation: Despite no current KEV listing or observed campaigns, the statistical model places this in the top 3% for near-term exploitation probability.
• Role multiplier: MLflow is canonically an ML pipeline infrastructure component (CI/CD + artifact store category). In production deployments, MLflow manages model artifacts, experiment metadata, and training jobs. The ability to submit arbitrary jobs constitutes potential code execution on the training backend — a supply-chain pivot on ML model production. This role represents the *majority* of MLflow installations by definition (it's purpose-built for this), placing the blast radius at supply-chain scale. The HIGH floor applies.
• ~3,000 publicly exposed instances: Shodan data confirms a non-trivial internet-facing population, and MLflow exposure grew 173% in H1 2026. The attack surface is growing, not shrinking.

Why not higher?

CRITICAL would require either active exploitation (KEV), a broader affected configuration (all MLflow deployments rather than basic-auth + ASGI only), or direct RCE confirmed in the default job execution backend. The configuration prerequisites meaningfully narrow the reachable population below what a CRITICAL rating demands. No public PoC or confirmed campaigns exist yet.

Why not lower?

The unauthenticated, zero-interaction attack surface (AV:N/AC:L/PR:N/UI:N) combined with MLflow's canonical role as ML infrastructure means the floor is HIGH. Arbitrary job submission on a model training platform is supply-chain risk by definition — model poisoning, credential exfiltration from training environments, and lateral movement into compute backends are all plausible outcomes. EPSS at 97th percentile independently supports HIGH.

1. Block unauthenticated access to /ajax-api/ and /v1/traces at the reverse proxy or WAF — Add deny rules in your nginx/Traefik/Cloudflare WAF config to require authentication on these paths. This is the fastest mitigation — deploy within the noisgate mitigation SLA of 30 days for HIGH, but ideally within days given the trivial exploitability.
2. Restrict MLflow network exposure to internal-only via firewall rules — MLflow Tracking Servers should not be internet-facing. Place them behind VPN or zero-trust network access. If already internal-only, validate that firewall rules prevent lateral access from untrusted segments. Deploy within 30 days per noisgate mitigation SLA.
3. Upgrade to MLflow 3.11.0 — The definitive fix. The patched _find_fastapi_validator() correctly enforces auth on all FastAPI routes. Schedule within the 180-day noisgate remediation SLA for HIGH.
4. Switch to gunicorn/WSGI serving if ASGI is not required — If your deployment does not specifically need uvicorn ASGI features, switching to gunicorn/Flask WSGI eliminates this attack vector entirely as the vulnerable FastAPI middleware is not loaded.
5. Audit MLflow job submission logs for unauthorized entries — Review /ajax-api/3.0/jobs/ access logs for unauthenticated requests since deployment. Look for job submissions from unexpected source IPs. This is forensic, not preventive — do it now.

Run this script on any host that can reach the target MLflow instance. Usage: bash check_cve_2026_2652.sh <mlflow_url> (e.g., bash check_cve_2026_2652.sh https://mlflow.internal:5000). No special privileges required — it only sends unauthenticated HTTP requests.

#!/usr/bin/env bash
# CVE-2026-2652 Checker — MLflow FastAPI Auth Bypass
# Tests whether /ajax-api/3.0/jobs/ and /v1/traces are accessible without auth
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <mlflow_base_url>"
  echo "Example: $0 https://mlflow.internal:5000"
  exit 2
fi

BASE_URL="${1%/}"
VULN=0

echo "[*] Testing CVE-2026-2652 against $BASE_URL"
echo

# Test 1: Job API endpoint (should require auth)
echo "[*] Test 1: Checking /ajax-api/3.0/jobs/ (unauthenticated)..."
HTTP_CODE_JOBS=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 10 --max-time 15 "$BASE_URL/ajax-api/3.0/jobs/" 2>/dev/null || echo "000")
echo "    HTTP response: $HTTP_CODE_JOBS"

if [[ "$HTTP_CODE_JOBS" =~ ^(200|201|204|405)$ ]]; then
  echo "    [!] Job API accessible WITHOUT authentication"
  VULN=1
elif [[ "$HTTP_CODE_JOBS" =~ ^(401|403)$ ]]; then
  echo "    [+] Job API correctly requires authentication"
elif [[ "$HTTP_CODE_JOBS" == "404" ]]; then
  echo "    [?] Job API not found — may not be running ASGI/FastAPI"
elif [[ "$HTTP_CODE_JOBS" == "000" ]]; then
  echo "    [?] Connection failed"
  echo "UNKNOWN — could not connect to $BASE_URL"
  exit 2
fi

# Test 2: Traces endpoint (should require auth)
echo "[*] Test 2: Checking /v1/traces (unauthenticated)..."
HTTP_CODE_TRACES=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 10 --max-time 15 "$BASE_URL/v1/traces" 2>/dev/null || echo "000")
echo "    HTTP response: $HTTP_CODE_TRACES"

if [[ "$HTTP_CODE_TRACES" =~ ^(200|201|204|405)$ ]]; then
  echo "    [!] Traces API accessible WITHOUT authentication"
  VULN=1
elif [[ "$HTTP_CODE_TRACES" =~ ^(401|403)$ ]]; then
  echo "    [+] Traces API correctly requires authentication"
elif [[ "$HTTP_CODE_TRACES" == "404" ]]; then
  echo "    [?] Traces API not found — may not be running ASGI/FastAPI"
fi

# Test 3: Confirm auth IS enforced on gateway (control test)
echo "[*] Test 3: Control — checking /gateway/ (should require auth)..."
HTTP_CODE_GW=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 10 --max-time 15 "$BASE_URL/gateway/" 2>/dev/null || echo "000")
echo "    HTTP response: $HTTP_CODE_GW"

if [[ "$HTTP_CODE_GW" =~ ^(401|403)$ ]]; then
  echo "    [+] Gateway auth enforced (confirms basic-auth is enabled)"
fi

echo
if [ "$VULN" -eq 1 ]; then
  echo "VULNERABLE — CVE-2026-2652: FastAPI routes bypass authentication"
  exit 0
else
  echo "PATCHED — FastAPI routes appear to enforce authentication correctly"
  exit 1
fi

Sources

1. GitHub Advisory GHSA-75cm-x2w3-8mgf
2. NVD — CVE-2026-2652
3. huntr.com Bounty Report
4. TheHackerWire — MLflow Unauthenticated API Access Bypass
5. Vulnerability-Lookup — CVE-2026-2652
6. OpenA2A Research — Internet-Wide AI Exposure Sweep April 2026
7. Echelon Shadow AI Radar — Live Exposed AI Infrastructure