CVE-2026-2635

MLflow Use of Default Password Authentication Bypass Vulnerability

State: Published
Severity: 9.8 Critical
Published: Feb 20, 2026
Updated: Jul 15, 2026
Reserved: Feb 17, 2026

Description

MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.

Scores

CVSS	Score	Vector	Source
3.0	9.8 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	zdi
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	redhat-SADP

Weaknesses

CWE-1393 Use of Default Password
CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
MLflowMLflow	3.4.0Affected

References

ZDI-26-111
vendor-provided URLvendor-advisory
https://access.redhat.com/security/cve/CVE-2026-2635vdb-entry
RHBZ#2441514issue-tracking
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2635.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.