CVE-2026-2652 | MLflow Authentication Bypass – Unauthenticated Access to FastAPI Routes

Severity: HIGH | CVSS: 8.6 | Published: May 15, 2026 | Fixed: mlflow 3.10.0

Introduction

This document illustrates an Authentication Bypass vulnerability in MLflow – an open-source Machine Learning lifecycle management platform maintained by Databricks and used by thousands of data science teams, financial institutions, and enterprise AI pipelines worldwide. Tracked as CVE-2026-2652, the vulnerability allows unauthenticated remote attackers to access protected FastAPI routes even when the server is explicitly configured with basic authentication. No credentials, prior foothold, or user interaction are required to exploit this flaw.

Safe Security analyzed this vulnerability during offensive research into AI and ML infrastructure attack surfaces by reproducing the exploit in a controlled sandbox environment against a self-hosted MLflow deployment.

MLflow Description

MLflow is an open-source platform for managing the complete machine learning lifecycle, including experimentation, reproducibility, deployment, and model registry operations. Released under the Apache 2.0 license, it is actively maintained by Databricks and an extensive open-source community. MLflow is deployed across research labs, enterprise data science teams, and production ML pipelines – including on-premises servers, self-hosted cloud VMs, and Kubernetes clusters – where it manages sensitive AI model artefacts, experiment metadata, and training run histories.

Vulnerability Severity

Scope of Impact

• Affected: mlflow/mlflow versions 3.9.0 and all earlier releases
• Condition: server started with –app-name basic-auth flag AND served via uvicorn (ASGI mode)
• Fixed: mlflow 3.10.0 and later
• Not affected: Databricks Managed MLflow, Azure Machine Learning MLflow integrations (separate auth planes)

Where is the vulnerability present?

The vulnerability resides in MLflow’s FastAPI permission middleware, specifically in the _find_fastapi_validator() function inside mlflow/server/auth/__init__.py. When the MLflow server is started with the –app-name basic-auth flag and served through uvicorn as an ASGI application, a middleware layer called fastapi_permission_middleware is responsible for intercepting all requests and enforcing authentication before they reach route handlers.

The critical flaw is that _find_fastapi_validator() only returns an authentication validator for routes beginning with /gateway/ — covering the AI Gateway API. For every other FastAPI-backed route, the function returns None, which the middleware interprets as: “this route is handled by Flask (WSGI), skip FastAPI auth.” In reality, the Job API (/ajax-api/3.0/jobs/*), the OpenTelemetry trace ingestion API (/v1/traces), and the MLflow Assistant API (/ajax-api/3.0/mlflow/assistant/*) are all FastAPI routes – but they fall through the validator entirely, receiving zero authentication enforcement.

The root cause is an architectural mismatch introduced as MLflow progressively migrated route handlers from Flask to FastAPI while the authentication layer was only partially updated. The fix (commit bb62e77, released in 3.10.0) adds explicit validator cases for all three unprotected route families, closing the bypass completely.

Risk

An unauthenticated attacker who can reach the MLflow server gains the ability to enumerate, submit, read, and cancel all machine learning jobs without credentials. This exposes an organisation’s entire ML pipeline – including hyperparameter configurations, dataset paths, model artefact locations, and experiment results that may contain proprietary intellectual property or regulated training data.

The Job API bypass enables an attacker to inject arbitrary jobs into the MLflow runtime. Depending on the job executor configuration and allowlisted job functions, this can escalate to unauthenticated remote code execution within the MLflow worker environment. In cloud deployments, worker processes commonly carry IAM role credentials or cloud metadata service tokens, enabling lateral movement into adjacent cloud infrastructure.

The OpenTelemetry trace injection path (/v1/traces) introduces a data integrity attack vector: an attacker can inject fabricated trace data into any experiment without authentication. In automated ML pipelines that gate model promotion on experiment metrics, injected traces could be weaponised to promote a malicious or degraded model to production – an attack with no visible forensic signature in the experiment UI.

The overall impact spans all three dimensions of the CIA triad: confidentiality (ML model and data exposure via job results), integrity (experiment poisoning and unauthorised job submission), and availability (job cancellation causing pipeline disruption and denial of service). Organisations operating automated, unattended ML pipelines with internet-accessible MLflow servers face the highest risk profile.

Mitigation

• Upgrade to mlflow 3.10.0 or later immediately. This release patches _find_fastapi_validator() to enforce authentication across all FastAPI route families.
• Apply network-layer controls: restrict access to the MLflow tracking server port (default 5000) using firewall rules, VPC security groups, or an IP allowlist. Do not expose the MLflow server directly to the internet.
• Deploy a reverse proxy (nginx, Traefik, or Caddy) with independent authentication middleware in front of MLflow to provide defence-in-depth regardless of application-layer bugs.
• For AWS deployments, enable AWS WAF with the GenericLFI_Body managed rule set, and add custom rules blocking unauthenticated requests to /ajax-api/ and /v1/traces paths.
• Audit all job submissions and experiment trace entries logged during the affected version window for signs of unauthorised activity or unexpected job execution.

Exploit Implementation

       1. Attack Scenario

 The lab environment consists of a Docker-based Linux setup running MLflow 3.9.0 with authentication enabled via –app-name basic-auth, served through uvicorn on port 5001.

      Prerequisites:

• Nuclei (latest) – for automated vulnerability confirmation
• curl – for all manual exploitation steps
• Network access to the MLflow server on port 5001

       2. Exploitation

1. Confirm the server is running with basic-auth enabled by probing a Flask-backed route. This establishes that authentication is active on the server.

The Flask route correctly blocks the unauthenticated request, confirming that basic-auth is configured and enforced on WSGI-backed endpoints.

2. Run the Nuclei template to confirm the authentication bypass on FastAPI routes.

   The Nuclei template probes the unprotected FastAPI endpoints and confirms the bypass is present without any credentials being supplied.

3. Exploit the authentication bypass directly: submit a search request to the Job API without any credentials. The server returns HTTP 200 – confirming zero authentication enforcement on this FastAPI route.

A 200 OK response with no Authorization header demonstrates that the FastAPI middleware completely fails to enforce authentication on this endpoint. An attacker can enumerate all jobs, read their results, and submit new job payloads without any account.

4. Demonstrate data integrity compromise: inject a trace into the OpenTelemetry ingestion endpoint without credentials. The server processes the request unauthenticated – returning a format error rather than 401 – confirming the bypass extends to experiment data.

The 400 response (not 401) proves the request bypassed all authentication and reached the FastAPI route handler. A real attacker sends a valid serialised OpenTelemetry protobuf payload at this step to inject fabricated spans into any experiment, silently poisoning ML metrics and model evaluation data.