Detections
Analytics

MLflow < 3.11.0 Authentication Bypass

high Web App Scanning Plugin ID 115253

Language:

Synopsis

MLflow < 3.11.0 Authentication Bypass

Description

MLflow versions prior to 3.11.0 are vulnerable to an authentication bypass vulnerability that allows attackers to access protected resources without proper authentication. This vulnerability arises from a flaw in the authentication mechanism, which can be exploited by attackers to gain unauthorized access to sensitive data and functionalities within the MLflow platform. This detection is included in the AI and LLM category.

Solution

Upgrade to MLflow 3.11.0 or later.

See Also

https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa

https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756

Plugin Details

Severity: High

ID: 115253

Type: Check Based

Published: 5/28/2026

Updated: 5/28/2026

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: High

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:P

CVSS Score Source: CVE-2026-2652

CVSS v3

Risk Factor: High

Base Score: 8.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

CVSS Score Source: CVE-2026-2652

Vulnerability Information

CPE: cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/14/2026

Vulnerability Publication Date: 5/14/2026

Reference Information

CVE: CVE-2026-2652