MLflow CVE-2026-2652: Quick Look at the FastAPI Authentication Bypass That Leaves Jobs and Traces Wide Open

Introduction

An authentication bypass in MLflow's FastAPI middleware lets unauthenticated remote attackers submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. This works even on servers that were explicitly configured with authentication enabled. The vulnerability, CVE-2026-2652, carries a CVSS score of 8.6 (High) and affects MLflow versions 3.9.0 and earlier when served via uvicorn.

MLflow is an open-source platform for managing the end-to-end machine learning lifecycle: experiment tracking, model packaging, deployment, and a central model registry. It is one of the most widely adopted MLOps tools in the industry, used by organizations of all sizes. Because MLflow sits at the center of so many ML workflows, an authentication bypass here is especially serious. It can expose model training data, job configurations, and operational pipelines.

Technical Information

Root Cause: Flask vs. FastAPI Authentication Mismatch

The root cause is an architectural mismatch between Flask and FastAPI inside the MLflow server. A request interceptor protects Flask routes and runs on every incoming request. FastAPI routes never pass through Flask, so they rely on a separate permission middleware.

That middleware calls a validator lookup function, _find_fastapi_validator(), to decide which authentication check applies to a given request. In affected versions, the function only recognizes paths under /gateway/. For any non-gateway FastAPI route, it returns null. The middleware reads null as "no authentication required" and passes the request through without any checks.

This is a textbook case of CWE-305 (Authentication Bypass by Primary Weakness). The system has an authentication mechanism in place, but a flaw in its implementation lets requests skip it entirely on specific routes.

Affected Endpoints and Attacker Capabilities

The middleware leaves these FastAPI routes unprotected:

Attack Flow

Exploitation is straightforward. It needs no privileges, no user interaction, and no special tooling:

1. The attacker identifies an MLflow server that is network accessible and configured with --app-name basic-auth served via uvicorn (ASGI).
2. The attacker sends an unauthenticated POST request to /ajax-api/3.0/jobs/search with an empty JSON payload.
3. The request hits the FastAPI permission middleware, which calls _find_fastapi_validator() with the request path.
4. Because the path does not start with /gateway/, the function returns null.
5. The middleware gets the null validator and lets the request through without authentication.
6. The server processes the request and returns a full listing of all jobs, including their parameters and results.

From there, the attacker can escalate by submitting new jobs (which may invoke scorers using the server's own gateway API keys), canceling running jobs to disrupt operations, or injecting fabricated trace data into experiments via the /v1/traces endpoint to corrupt observability data.

Fix in Version 3.10.0

The upstream patch (commit bb62e77) updates _find_fastapi_validator() to handle all FastAPI routes, not just gateway paths. It adds specific validators for the trace ingestion and job APIs. The fix also adds comprehensive tests confirming that unauthenticated requests to these endpoints return a 401 Unauthorized status code, so a future regression would fail the test suite.

Affected Systems and Versions

The vulnerability affects MLflow versions 3.9.0 and earlier in this specific configuration:

• MLflow server started with authentication enabled using the --app-name basic-auth flag
• Server served via uvicorn (ASGI mode)

Deployments that do not use the basic auth app name, or that are served through a different WSGI/ASGI server configuration, may not be affected in the same way. The underlying code flaw is still present in all versions prior to 3.10.0.

MLflow version 3.10.0 includes the fix.

References

• NVD: CVE-2026-2652
• CVE Record: CVE-2026-2652
• huntr Bounty Report
• Fix Commit: Add missing authentication for FastAPI routes (#20920)
• MLflow Releases on GitHub