CVE-2026-2635

What it actually does

The flaw is an authentication bypass caused by hard-coded default credentials in MLflow's basic_auth.ini configuration. A remote, unauthenticated attacker who can reach the MLflow service can authenticate as an administrator using the default credential material and then perform privileged MLflow actions. Because administrator access to MLflow can control experiments, models, artifacts, and execution-related workflows, successful exploitation can lead to arbitrary code execution in the context of the MLflow administrator process, as well as full compromise of confidentiality, integrity, and availability of the MLflow deployment.

Why it matters to the business

An exposed vulnerable MLflow server could be taken over without needing a valid account, allowing attackers to steal models and experiment data, tamper with machine learning pipelines, poison model artifacts, disrupt model operations, or use the server as a foothold for deeper compromise. The CVSS score is critical at 9.8, but EPSS is currently low at 0.00968 and the issue is not listed in CISA KEV, so organizations should treat internet-exposed or production MLflow instances as urgent while prioritizing based on exposure.

How an attack unfolds

An attacker first identifies an accessible MLflow tracking or model registry server. They then attempt authentication using the hard-coded default credentials present in the MLflow basic_auth.ini configuration. If accepted, the attacker obtains administrator-level access without prior credentials or user interaction. From that position, the attacker can enumerate experiments, runs, registered models, artifacts, and users; modify or delete MLflow resources; upload or alter artifacts; and abuse MLflow functionality or surrounding automation to execute code with the privileges of the MLflow service administrator. In a mature attack, the adversary may establish persistence by creating additional users or credentials, modifying models or artifacts to trigger downstream execution, and deleting or altering records to hide the intrusion.

How to fix it

Upgrade MLflow to a vendor-fixed version as soon as a fixed release is available. No exact fixed versions were provided in the input, so verify the current MLflow advisory and package release notes before remediation. Immediately remove hard-coded or default credentials from basic_auth.ini, change the default administrator username and password, and rotate any credentials that may have been exposed through MLflow. Recreate or update the MLflow authentication database if it was initialized with default administrator credentials. Restrict MLflow network access to trusted users and systems only; do not expose MLflow directly to the internet. Place MLflow behind a mature identity-aware proxy, SSO/OIDC gateway, VPN, or reverse proxy enforcing strong authentication and MFA. Review MLflow service account privileges and run it with least privilege. Audit and clean experiments, artifacts, registered models, webhooks, integrations, and automation that could have been modified by an attacker. If compromise is suspected, rebuild the MLflow environment from trusted sources and validate model artifacts before reuse.

How to confirm the fix worked

Confirm whether the deployed MLflow version and authentication configuration are affected by reviewing installed package versions, deployment manifests, container images, and MLflow release notes. Inspect basic_auth.ini and related authentication configuration for default administrator credentials, especially admin_username set to admin and admin_password set to password. Attempt a controlled authentication test from an authorized security workstation to verify that default credentials are rejected. Validate that MLflow is not reachable from untrusted networks or the public internet. Confirm that authentication is enforced at the MLflow application and any upstream proxy. Review the MLflow authentication database and user list for unexpected administrator accounts. After remediation, restart MLflow services, re-test login behavior, verify that old sessions or tokens are invalidated where applicable, and ensure monitoring alerts on future default-credential login attempts.

Typical attack path

1. Discover an exposed MLflow server through scanning, search engines, source-code references, or cloud asset enumeration.
2. Access the MLflow web interface or API endpoint over the network.
3. Authenticate using the hard-coded default basic-auth credentials from basic_auth.ini.
4. Confirm administrator privileges by querying MLflow users, experiments, runs, registered models, or admin-only API functions.
5. Enumerate sensitive MLflow content such as model artifacts, experiment metadata, credentials embedded in run parameters, and deployment information.
6. Modify, upload, or replace artifacts or model versions to influence downstream ML workflows.
7. Trigger or wait for automated pipelines to consume attacker-controlled content, potentially achieving code execution in the MLflow service or connected ML environment.
8. Create persistence through additional accounts, changed configuration, planted artifacts, or altered model registry entries.
9. Cover tracks by deleting runs, models, artifacts, logs, or audit-relevant metadata.

How to detect it

Review MLflow application logs, reverse proxy logs, load balancer logs, web server access logs, container logs, Kubernetes ingress logs, authentication database records, and operating system process/file audit logs. Look for successful HTTP Basic authentication attempts using the default administrator credential pair, especially from unfamiliar IP addresses, cloud hosting providers, TOR/VPN infrastructure, or scanners. Examine access to MLflow API routes shortly after login, including creation or modification of experiments, runs, registered models, model versions, artifacts, users, and permissions. Investigate unexpected writes under the MLflow artifact store, new or altered model files, suspicious pickle/python artifacts, shell scripts, notebooks, or binaries. Review MLflow authentication configuration and auth database changes for newly created admin users or password changes. Check service logs and host telemetry for child processes spawned by MLflow, unusual outbound network connections, package installations, shell execution, reverse shells, or credential access. Because exploit maturity is currently listed as none and the CVE is not in CISA KEV, there may be no widely standardized exploit fingerprint; prioritize behavioral evidence of default credential use, unauthorized admin activity, artifact tampering, and MLflow service process abuse.

• basic_auth.ini
• admin_username = admin
• admin_password = password
• Authorization: Basic YWRtaW46cGFzc3dvcmQ=
• admin:password
• /api/2.0/mlflow/experiments
• /api/2.0/mlflow/runs
• /api/2.0/mlflow/registered-models
• /api/2.0/mlflow/model-versions
• /api/2.0/mlflow/users
• /ajax-api/2.0/mlflow/experiments
• /ajax-api/2.0/mlflow/runs
• /ajax-api/2.0/mlflow/registered-models
• mlflow server
• mlflow.server.auth:authenticate_request_basic_auth
• basic_auth.db

What your security team should do

• Immediately inventory all MLflow servers, containers, notebooks, model registry services, and tracking servers across cloud, Kubernetes, VM, and developer environments.
• Prioritize remediation for internet-facing MLflow instances and any deployments connected to production ML pipelines, sensitive datasets, or model deployment automation.
• Check basic_auth.ini and authentication database state for default administrator credentials; rotate credentials and remove defaults immediately.
• Restrict network exposure using private networking, firewall rules, security groups, VPN, or identity-aware proxy controls.
• Upgrade to a fixed MLflow release when available and track vendor advisories because exact fixed versions were not provided.
• Audit MLflow users, registered models, experiments, runs, artifacts, webhooks, and integrations for unauthorized changes since the vulnerable deployment began.
• Search logs for successful basic-auth logins using default credentials and suspicious administrative API calls.
• Rotate secrets that may have been stored in MLflow parameters, tags, artifacts, environment variables, or connected CI/CD systems.
• Validate model and artifact integrity before allowing downstream training, evaluation, deployment, or batch inference pipelines to consume them.
• Add SIEM detections for default MLflow credential use, unexpected admin activity, suspicious artifact uploads, and MLflow access from unfamiliar IP addresses or user agents.