Executive brief
MLflow, a platform used to manage machine learning lifecycles, contains a security flaw where it uses a default password that is easily guessable. This allows an unauthorized person to log into the system with administrative privileges without needing to know a unique password. Once logged in, an attacker could steal sensitive data, disrupt machine learning operations, or take full control of the server.
Technical details
A vulnerability exists in MLflow's authentication mechanism due to the presence of hard-coded default credentials within the 'basic_auth.ini' configuration file. This is classified as a Use of Default Password (CWE-1393) or Use of Hard-coded Credentials (CWE-798). A remote, unauthenticated attacker can leverage these credentials to bypass authentication entirely. Successful exploitation grants the attacker administrative privileges, which can be further leveraged to execute arbitrary code in the context of the administrator. The vulnerability was addressed in MLflow version 3.7.1 via a pull request that also addressed related path traversal issues.
Affected products
- MLflow MLflow 3.4.0
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2025-10-14: disclosed: Vulnerability reported to vendor
- 2025-12-10: patched: Fix merged in GitHub pull request 19260
- 2026-02-19: advisory: ZDI advisory published
- 2026-02-20: advisory: NVD/CVE published