Paper/Archive/CVE-2026-2635

CVE-2026-2635

MLflow MLflow — MLflow Use of Default Password Authentication Bypass Vulnerability

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 65.0.650 × 2013.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.

Affected

ProductAffectedFixed inSource

MLflow3.4.0–CNA

Red Hat OpenShift AI (RHOAI)see advisory–redhat-SADP

Scores by source

zdi (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

redhat-SADP (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refzerodayinitiative.com/advisories/ZDI-26-111 advisorygithub.com/mlflow/mlflow/pull/19260 refaccess.redhat.com/security/cve/CVE-2026-2635 refbugzilla.redhat.com/show_bug.cgi?id=2441514 refsecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2635.json