CVE-2026-2635: MLflow Authentication Bypass Vulnerability

CVE-2026-2635 Overview

CVE-2026-2635 is a critical authentication bypass vulnerability affecting MLflow, a popular open-source platform for managing the machine learning lifecycle. The vulnerability stems from the use of hardcoded default credentials in the basic_auth.ini configuration file, allowing remote attackers to bypass authentication mechanisms without requiring any prior authentication.

This flaw enables unauthenticated attackers to gain administrative access to MLflow installations, potentially leading to arbitrary code execution within the context of the administrator. The vulnerability was tracked by the Zero Day Initiative as ZDI-CAN-28256.

Critical Impact

Remote attackers can bypass authentication using hardcoded default credentials, gaining full administrative access to MLflow installations and the ability to execute arbitrary code.

Affected Products

• MLflow installations with default basic_auth.ini configuration
• MLflow deployments using basic authentication without credential rotation
• Self-hosted MLflow instances with unmodified authentication settings

Discovery Timeline

• 2026-02-20 - CVE-2026-2635 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-2635

Vulnerability Analysis

This authentication bypass vulnerability falls under CWE-1393 (Use of Default Password) and represents a significant security risk for organizations using MLflow in production environments. The flaw exists within the basic_auth.ini configuration file, which ships with hardcoded default credentials that many administrators fail to change during deployment.

The vulnerability is particularly dangerous because it requires no authentication to exploit. An attacker who can reach an MLflow instance over the network can leverage the default credentials to authenticate as an administrator. Once authenticated, the attacker gains full control over the MLflow platform, including the ability to manipulate machine learning models, access sensitive training data, and execute arbitrary code within the administrative context.

Machine learning platforms like MLflow often have access to sensitive datasets, proprietary models, and integration with production systems, making this vulnerability especially impactful for organizations in AI/ML-intensive industries.

Root Cause

The root cause of this vulnerability is the inclusion of hardcoded default credentials in the basic_auth.ini configuration file. When MLflow is deployed without explicitly changing these credentials, the installation remains vulnerable to authentication bypass. This represents a fundamental security design flaw where secure defaults were not enforced, leaving the burden of credential rotation entirely on administrators who may be unaware of the risk.

Attack Vector

The attack vector for CVE-2026-2635 is network-based, requiring no user interaction and no privileges to exploit. An attacker can remotely connect to an exposed MLflow instance and attempt authentication using the default credentials stored in basic_auth.ini. Upon successful authentication, the attacker gains administrative privileges.

The attack flow typically involves:

1. Identifying an exposed MLflow instance through network scanning or reconnaissance
2. Attempting authentication using known default credentials from the basic_auth.ini file
3. Upon successful authentication, gaining full administrative access to the MLflow platform
4. Leveraging administrative privileges to execute arbitrary code, exfiltrate data, or manipulate ML models

For detailed technical information about this vulnerability, refer to the Zero Day Initiative Advisory and the GitHub Pull Request containing the fix.

Detection Methods for CVE-2026-2635

Indicators of Compromise

• Successful authentication attempts from unknown or suspicious IP addresses using default credentials
• Unexpected administrative actions in MLflow audit logs from accounts that should not have access
• Multiple failed authentication attempts followed by a successful login using default credentials
• Unusual code execution or model modifications performed by the default administrative account

Detection Strategies

• Review MLflow authentication logs for login attempts using the default username
• Implement network monitoring to detect connections to MLflow from unauthorized sources
• Audit basic_auth.ini files across all MLflow deployments to identify instances using default credentials
• Deploy intrusion detection rules to alert on authentication patterns consistent with default credential usage

Monitoring Recommendations

• Enable verbose logging for all MLflow authentication events and administrative actions
• Set up alerts for successful logins from previously unseen IP addresses or geographic locations
• Monitor for unusual API activity patterns that may indicate unauthorized administrative access
• Implement continuous configuration scanning to detect basic_auth.ini files with default credentials

How to Mitigate CVE-2026-2635

Immediate Actions Required

• Change all default credentials in basic_auth.ini immediately across all MLflow deployments
• Audit all MLflow instances to identify any that may still be using default authentication settings
• Restrict network access to MLflow instances using firewall rules and network segmentation
• Review authentication logs for evidence of exploitation or unauthorized access

Patch Information

The MLflow maintainers have addressed this vulnerability. Organizations should review the GitHub Pull Request #19260 for the specific fix and update their MLflow installations to a patched version. The patch removes the reliance on default credentials and enforces secure credential configuration during initial setup.

Workarounds

• Replace default credentials in basic_auth.ini with strong, unique passwords before deploying MLflow
• Implement additional authentication layers such as SSO or multi-factor authentication
• Place MLflow instances behind a VPN or reverse proxy with additional authentication requirements
• Disable basic authentication entirely if an alternative authentication mechanism is available

# Configuration example - Replace default credentials in basic_auth.ini
# Locate and backup the original configuration file
cp /path/to/mlflow/basic_auth.ini /path/to/mlflow/basic_auth.ini.backup

# Edit the configuration to use strong credentials
# Replace default username and password with unique values
# Ensure file permissions restrict access to authorized users only
chmod 600 /path/to/mlflow/basic_auth.ini
chown mlflow:mlflow /path/to/mlflow/basic_auth.ini