PT-2026-53503 · Pypi · Mlflow

Publicado 2026-06-29 · Atualizado 2026-06-29

OSV

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the basic auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator.

Correção

Identificadores relacionados

PYSEC-2026-421

Produtos afetados

Mlflow

Referências · 9

• https://github.com/mlflow/mlflow/releases/tag/v3.8.0rc0 · Nota
• https://github.com/mlflow/mlflow · Nota
• https://github.com/mlflow/mlflow/pull/19260 · Nota
• https://github.com/mlflow/mlflow/commit/5bf2ec2bd4222a18d78631183ac7f6b752afe8a4 · Nota
• https://pypi.org/project/mlflow · Nota
• https://github.com/advisories/GHSA-gq3w-7jj3-x7gr · Nota
• https://zerodayinitiative.com/advisories/ZDI-26-111 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2635 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2026-421 · Aviso do Fabricante