CVE-2026-2652: mlflow authentication bypass on FastAPI routes allows unauthenticated job access

Summary

CVE-2026-2652 affects mlflow/mlflow versions 3.9.0 and earlier when started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware enforces authentication only on `/gateway/` routes, leaving the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. Unauthenticated remote attackers can submit, read, and cancel jobs and inject arbitrary trace data into experiments, because `_find_fastapi_validator()` fails to handle non-`/gateway/` paths.

Mitigation

Fixed in 3.10.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Related items

• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek