9.8
Critique
CVE-2026-2635 MLflow Use of Default Password Authentication Bypass Vulnerability
Description
MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Versions non publiées | |
| MLflow | 3.4.0 | Pas de correctif indiqué |
Autres CVE de Red Hat OpenShift AI (RHOAI)
Les 390 CVE de Red Hat OpenShift AI (RHOAI) →
CVE-2026-83494
Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)
Non notée
CVE-2026-83493
Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master
Non notée
CVE-2026-107912
Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
7.7
Élevée
CVE-2026-120194
Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
7.5
Élevée