CVE-2026-0545: mlflow/mlflow - Missing Authentication for Critical Function in Job API
The record describes missing authentication and authorization on FastAPI job endpoints in mlflow/mlflow when the basic-auth app is enabled, which can let unauthenticated network clients submit, read, search and cancel jobs under the stated conditions. NVD lists a CVSS base score of 9.8 and CWE-306. The sources consulted show no confirmed exploitation in the wild, the CVE is not listed in KEV in the record, and no fixed version is listed.
Overview
The CVE record describes missing authentication and authorization on the FastAPI job endpoints of mlflow/mlflow. The issue depends on the basic-auth app being enabled, job execution being turned on, and at least one job function being allowlisted. The NVD entry classifies the weakness as CWE-306, Missing Authentication for Critical Function. See the NVD entry and the CVE Record.
Impact
According to the record, the stated consequences include:
- Unauthenticated submission, reading, searching and cancellation of jobs, bypassing basic-auth.
- Possible unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes.
- Even when no code execution occurs, job spam, denial of service and exposure of data in job results.
The NVD base score is 9.8 (critical). Other providers listed in the record give scores between 8.1 and 9.1.
Affected products and versions
- Lfprojects Mlflow: the record states that the versions are not specified by the source.
- Mlflow Mlflow: the record lists the affected range as up to and including the latest version of the repository.
The record lists no fixed version. The absence of a listed fix does not mean that no fix exists, so the current fix status is unknown from the available data.
Exploitation status
The record marks the CVE as not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC data in the record gives an exploitation level of proof of concept, and the Huntr bounty page is tagged as exploit-related. These points suggest that technical material may be public, but they do not confirm active exploitation.
Remediation and mitigation
- Check whether job execution is enabled in your deployment. If it is not required, keep it disabled.
- Review the job function allowlist and remove any function that is not strictly needed, especially functions that perform shell or filesystem operations.
- Restrict network access to the MLflow server to trusted clients and do not expose job endpoints to untrusted networks.
- Do not rely on basic-auth alone for these endpoints. Place an additional authentication layer in front of the job API until a vendor fix is confirmed.
- Follow the Red Hat CVE page and the vendor channels for an updated fixed version, and apply it when it is published.
Detection guidance
- Review server access logs for requests to job API paths that lack valid credentials or come from unexpected sources.
- Look for job creation, cancellation or search activity that does not match known operator behavior, and for job results containing unfamiliar data.
- When job execution is enabled, watch for unusual process activity or file changes on the host.
Limitations of the available information
The record does not specify affected versions for one listed product, provides no fixed version and includes no vendor patch details. The Red Hat and Bugzilla references are listed, but their contents were not part of the record. Whether a given deployment is exposed depends on its configuration, which the record does not describe.
Frequently asked questions
Does this CVE affect every MLflow deployment?
Not necessarily. According to the record, the issue requires the basic-auth app to be enabled, job execution to be turned on, and at least one job function to be allowlisted. Deployments without these conditions are described as not exposed in the same way, but the exact exposure depends on local configuration.
Is there a confirmed fixed version?
The record does not list a fixed version. The absence of a listed fix does not prove that none exists, so check the vendor and the Red Hat references for updates.
Is this vulnerability being actively exploited?
The record does not list the CVE in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The record does indicate a proof-of-concept exploitation level, so prioritizing the mitigations is reasonable.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.