CVE-2026-2652

What it actually does

MLflow 3.9.0 and earlier can fail to apply authentication to FastAPI-backed routes when the server is launched with authentication enabled using `--app-name basic-auth` and served through uvicorn/ASGI. Authentication is enforced only for `/gateway/` FastAPI routes, while other FastAPI routes such as `/ajax-api/3.0/jobs/*` and `/v1/traces` remain reachable without credentials. An unauthenticated remote attacker can interact with exposed APIs to submit jobs, read job output, cancel jobs, and inject arbitrary OpenTelemetry trace data. The root cause is an authentication architecture mismatch between Flask and FastAPI routing, where the FastAPI permission validator does not correctly cover non-`/gateway/` paths.

Why it matters to the business

An internet- or network-exposed MLflow service may appear to require login while still allowing unauthenticated users to operate sensitive APIs. This can disrupt machine-learning operations by cancelling or submitting jobs, expose job results, pollute experiment telemetry with false trace data, and potentially consume compute resources. In environments where MLflow jobs trigger downstream execution workflows, the operational impact may extend to unauthorized workload execution or pipeline manipulation. The issue has weaponized exploit maturity and an EPSS probability of approximately 18.9%, so exposed instances should be treated as high priority even though it is not currently listed in CISA KEV or known to be used in ransomware campaigns.

How an attack unfolds

An attacker first identifies an MLflow tracking or application server running version 3.9.0 or earlier with basic authentication enabled and served via uvicorn. Although normal browser access or Flask-backed routes may prompt for credentials, the attacker sends direct HTTP requests to FastAPI routes that are not under `/gateway/`. Because the FastAPI permission middleware does not enforce authentication for those paths, the server accepts requests without valid credentials. The attacker can then call Job API endpoints under `/ajax-api/3.0/jobs/` to enumerate or read job information, submit new jobs, or cancel active jobs. They can also post crafted telemetry to `/v1/traces` to inject misleading or malicious trace data into MLflow experiments. If the deployment integrates MLflow jobs with compute backends or automation, the attacker may use the bypass to interfere with model development, CI/CD-like workflows, or resource usage.

How to fix it

Upgrade MLflow to version 3.10.0 or later, which fixes the FastAPI authentication coverage issue. If immediate upgrade is not possible, restrict network access to MLflow servers using firewall rules, private networking, VPN, reverse proxy allowlists, or identity-aware access controls. Do not expose MLflow services directly to the internet. Place an authenticated reverse proxy in front of MLflow and enforce authentication and authorization for all paths, especially `/ajax-api/3.0/jobs/` and `/v1/traces`. Consider temporarily disabling or blocking vulnerable FastAPI routes at the proxy layer if they are not required. Review job execution integrations and compute backends for abuse, and rotate any credentials or tokens that could have been exposed through job results or traces.

How to confirm the fix worked

Confirm the installed MLflow version is 3.10.0 or later using package inventory, container image metadata, or `mlflow --version`. Verify runtime launch parameters and deployment mode to determine whether affected servers were started with `--app-name basic-auth` and served by uvicorn/ASGI. From an unauthenticated test client, attempt to access representative protected FastAPI paths such as `/ajax-api/3.0/jobs/` and `/v1/traces`; a fixed or properly mitigated deployment should return an authentication failure or proxy denial rather than a successful API response. Review reverse proxy rules to ensure authentication is applied consistently to all MLflow paths, not just browser-facing routes. Validate that job submission, job cancellation, job result retrieval, and trace ingestion all require valid credentials.

Typical attack path

1. Discover an exposed MLflow server and fingerprint it as a vulnerable version or vulnerable deployment pattern.
2. Confirm the server is served through uvicorn/ASGI and was started with authentication enabled using `--app-name basic-auth`.
3. Attempt unauthenticated direct access to non-`/gateway/` FastAPI routes such as `/ajax-api/3.0/jobs/*` or `/v1/traces`.
4. Use successful unauthenticated responses to enumerate job metadata or retrieve job results.
5. Submit new jobs or cancel running jobs through the Job API.
6. Inject arbitrary OpenTelemetry trace data through `/v1/traces` to pollute experiment telemetry or obscure activity.
7. Persist operational impact by repeatedly submitting jobs, cancelling workflows, or feeding misleading trace records until the server is patched or access is blocked.

How to detect it

Review uvicorn, reverse proxy, load balancer, API gateway, WAF, and MLflow application logs for successful unauthenticated requests to FastAPI routes outside `/gateway/`, especially `/ajax-api/3.0/jobs/` and `/v1/traces`. Prioritize requests with HTTP 200, 201, 202, or 204 responses that lack an `Authorization` header, session cookie, or expected authenticated identity. Look for POST requests to job creation, cancellation, or trace ingestion endpoints from unfamiliar IP addresses, automation tools, cloud scanners, or user agents not associated with normal MLflow clients. Correlate suspicious API requests with MLflow job metadata: unexpected job creation, cancelled jobs, unusual parameters, abnormal run timing, or job results accessed by unknown sources. For trace abuse, review OpenTelemetry ingestion volume, malformed trace payloads, unexpected service names, high-cardinality attributes, or traces not tied to legitimate applications. If logs are behind a reverse proxy, ensure original client IP headers are preserved before scoping activity. Also examine shell history, process launch records, deployment manifests, and container startup commands for `--app-name basic-auth` combined with uvicorn/ASGI exposure to identify vulnerable runtime configurations.

• /ajax-api/3.0/jobs/
• /ajax-api/3.0/jobs
• /v1/traces
• POST /ajax-api/3.0/jobs/
• GET /ajax-api/3.0/jobs/
• DELETE /ajax-api/3.0/jobs/
• POST /v1/traces
• "/ajax-api/3.0/jobs/" 200
• "/ajax-api/3.0/jobs/" 201
• "/ajax-api/3.0/jobs/" 202
• "/ajax-api/3.0/jobs/" 204
• "/v1/traces" 200
• "/v1/traces" 201
• "/v1/traces" 202
• --app-name basic-auth
• uvicorn

What your security team should do

• Inventory all MLflow servers, containers, and images and identify any running MLflow 3.9.0 or earlier.
• Prioritize remediation for MLflow instances reachable from the internet, shared networks, CI/CD systems, model-development platforms, or production-adjacent compute environments.
• Upgrade affected deployments to MLflow 3.10.0 or later.
• Until patched, block unauthenticated access to `/ajax-api/3.0/jobs/`, `/v1/traces`, and other nonessential MLflow API paths at a reverse proxy or network control point.
• Hunt historical access logs for unauthenticated successful requests to `/ajax-api/3.0/jobs/` and `/v1/traces`, especially POST requests and requests without `Authorization` headers.
• Review MLflow job history for unexpected submissions, cancellations, unusual parameters, unfamiliar users, odd timestamps, or jobs launched from unknown source IPs.
• Inspect experiment traces for abnormal volume, malformed attributes, unexpected service names, or trace data not associated with legitimate workloads.
• Assess whether job results or trace payloads contained secrets, credentials, model artifacts, or sensitive business data and rotate exposed secrets if needed.
• Add SIEM detections for unauthenticated or anomalous access to MLflow FastAPI routes and alert on job submission/cancellation from untrusted IP ranges.
• Because exploit maturity is weaponized and the issue is 87 days past publication, treat unpatched externally reachable systems as potentially compromised until logs and job history are reviewed.