Home

Description

MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.

PUBLISHED Reserved 2026-02-17 | Published 2026-02-20 | Updated 2026-02-24 | Assigner zdi




CRITICAL: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-1393: Use of Default Password

Product status

Default status
unknown

3.4.0
affected

References

www.zerodayinitiative.com/advisories/ZDI-26-111/ (ZDI-26-111)

github.com/mlflow/mlflow/pull/19260 (vendor-provided URL) vendor-advisory

cve.org (CVE-2026-2635)

nvd.nist.gov (CVE-2026-2635)

Download JSON