CVE-2026-0545

[CVE catalog]

Severity

Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Apr 3, 2026, 5:03:12 PM UTC

Source

[NVD] · [CVE record]

EPSS

4.39% · Oct 25, 2026

A flaw was found in mlflow/mlflow. When the `basic-auth` application is enabled, the FastAPI job endpoints are not protected by authentication or authorization. A remote attacker can exploit this by sending requests to these endpoints, bypassing security measures entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions, or potentially result in job spam, denial of service (DoS), or data exposure. mlflow/mlflow: mlflow/mlflow: Unauthenticated remote code execution via unprotected job endpoints This Important flaw in MLflow allows unauthenticated access to FastAPI job endpoints when `basic-auth` is enabled, bypassing security controls. A remote attacker could exploit this to achieve unauthenticated remote code execution if job execution is enabled and configured for privileged operations. This also poses risks of denial of service and data exposure. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.