Aller au contenu
en Se connecter
9.1 Critique

CVE-2026-0545 In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or…

Description

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.

Produits et versions touchés

Produit Versions touchées Corrigé en
mlflow/mlflow Versions non publiées
Red Hat OpenShift AI (RHOAI) Versions non publiées
Red Hat OpenShift AI 3.4 1787073593 premières → < 1787073593 1787073593

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de mlflow/mlflow

Les 55 CVE de mlflow/mlflow →
CVE-2026-8147 In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper… 8.1 Élevée CVE-2026-4035 A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI… 9.1 Critique CVE-2026-3198 MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API… 6.5 Moyenne CVE-2026-2651 A vulnerability in MLflow… 9.0 Critique
Suivre cette CVE