CVE-2026-2635

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-2635

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2635.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-2635

Aliases

Published

2026-02-20T22:25:03.494Z

Modified

2026-07-16T03:30:56.181049607Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

MLflow Use of Default Password Authentication Bypass Vulnerability

Details

MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.

Database specific

{
    "cna_assigner": "zdi",
    "cwe_ids": [
        "CWE-1393"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2635.json"
}

References

Affected packages

Git / github.com/mlflow/mlflow

Affected ranges

Type

GIT

Repo

https://github.com/mlflow/mlflow

Events

Introduced

78d075062b120597050bf2b3839a426feea5ea4c

Last affected

78d075062b120597050bf2b3839a426feea5ea4c

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.4.0"
        },
        {
            "last_affected": "3.4.0"
        }
    ]
}

Affected versions

3.*

3.4.0

v3.*

v3.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2635.json"