CVE-2026-2635 MLflow CVE debrief

Who should care

Organizations using MLflow should prioritize patching this vulnerability to prevent potential attacks. The vulnerability's high severity and ease of exploitation make it a critical concern for MLflow users. Additionally, security teams and administrators responsible for managing MLflow installations should be aware of this vulnerability and take immediate action to mitigate the risk.

Technical summary

The vulnerability exists in the basic_auth.ini file of MLflow, which contains hard-coded default credentials. This allows remote attackers to bypass authentication and execute arbitrary code as an administrator. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating a high severity. The weakness associated with this vulnerability is CWE-1393, and a secondary weakness is CWE-798.

Defensive priority

This vulnerability has a high defensive priority due to its severity and ease of exploitation. Organizations should prioritize patching this vulnerability to prevent potential attacks.

Recommended defensive actions

• Apply the official patch or update MLflow to a version that addresses this vulnerability.
• Review and update the basic_auth.ini file to remove any hard-coded default credentials.
• Implement additional security measures, such as multi-factor authentication, to enhance the security of MLflow installations.
• Monitor MLflow installations for any suspicious activity and ensure that the latest security updates are applied.
• Consider implementing compensating controls, such as network segmentation or access controls, to limit the impact of a potential attack.

Evidence notes

The CVE-2026-2635 vulnerability was reported by the Zero Day Initiative (ZDI) and has been publicly disclosed. The vulnerability has a CVSS score of 7.3 and is considered high-severity. The NVD and CVE.org provide additional information about this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.