Is CVE-2026-2652 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2652 being exploited in the wild.

How severe is CVE-2026-2652?

High severity, with a CVSS score of 8.6, published 15 May 2026.

Which products and versions are affected?

mlflow (PyPI) < 3.11.0, ECOSYSTEM:introduced=0,fixed=3.10.0, ECOSYSTEM:introduced=0,fixed=3.11.0.

Is there a fix for CVE-2026-2652?

Yes. mlflow (PyPI): upgrade to 3.10.0, 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2652 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-2652?

Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2652: MLflow authentication bypass in FastAPI routes

Q: Which products and versions are affected?

mlflow (PyPI) < 3.11.0, ECOSYSTEM:introduced=0,fixed=3.10.0, ECOSYSTEM:introduced=0,fixed=3.11.0.

Q: Is there a fix for CVE-2026-2652?

Yes. mlflow (PyPI): upgrade to 3.10.0, 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-2652 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-2652?

Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2652 · Severity: high · CVSS 8.6 · Published 2026-05-15

MLflow is an open-source platform used by data scientists to manage the machine learning lifecycle, including experiment tracking and model deployment. A security flaw allows unauthorized users to bypass login requirements when the server is configured with basic authentication. This could allow an attacker to remotely submit or cancel machine learning jobs, view sensitive results, and corrupt experiment data, potentially disrupting research and development operations.

Technologies: mlflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-2652 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2652 being exploited in the wild.
How severe is CVE-2026-2652?: High severity, with a CVSS score of 8.6, published 15 May 2026.
Which products and versions are affected?: mlflow (PyPI) < 3.11.0, ECOSYSTEM:introduced=0,fixed=3.10.0, ECOSYSTEM:introduced=0,fixed=3.11.0.
Is there a fix for CVE-2026-2652?: Yes. mlflow (PyPI): upgrade to 3.10.0, 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2652 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-2652?: Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mlflow (PyPI): upgrade to 3.10.0, 3.11.0 or later
```
pip install "mlflow>=3.11.0"
```

Technical details

An authentication bypass exists in MLflow versions prior to 3.11.0 due to an architectural mismatch between Flask and FastAPI authentication mechanisms. When MLflow is served via uvicorn (ASGI) with '--app-name basic-auth', the FastAPI permission middleware incorrectly restricts authentication enforcement to '/gateway/' routes only. The '_find_fastapi_validator()' function fails to validate other paths, leaving the Job API ('/ajax-api/3.0/jobs/*') and OpenTelemetry trace ingestion API ('/v1/traces') unprotected. A remote, unauthenticated attacker can exploit this to perform administrative actions such as job submission, cancellation, and data injection. The issue is resolved in version 3.11.0 (noting some documentation mentions 3.10.0, the package metadata specifies 3.11.0).

Affected products

MLflow MLflow < 3.11.0

Identifiers

CVE-2026-2652
GHSA-75cm-x2w3-8mgf
PYSEC-2026-2221

Timeline

2026-05-15: advisory: Initial disclosure via GitHub Advisory and NVD
2026-05-21: other: Advisory updated and reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.