PT-2026-53503 · Pypi · Mlflow

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the basic auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator.

Fix

Related Identifiers

PYSEC-2026-421

Affected Products

Mlflow

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-2635 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-421 · Vendor Advisory
• https://github.com/mlflow/mlflow/releases/tag/v3.8.0rc0 · Note
• https://github.com/mlflow/mlflow · Note
• https://github.com/mlflow/mlflow/pull/19260 · Note
• https://github.com/mlflow/mlflow/commit/5bf2ec2bd4222a18d78631183ac7f6b752afe8a4 · Note
• https://pypi.org/project/mlflow · Note
• https://github.com/advisories/GHSA-gq3w-7jj3-x7gr · Note
• https://zerodayinitiative.com/advisories/ZDI-26-111 · Note