# CVE-2026-2652: MLflow authentication bypass in FastAPI routes

Source: https://junglewise.ai/threats/cve-2026-2652-mlflow-authentication-bypass-in-fastapi-routes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-2652 · Severity: high · CVSS 8.6 · Published 2026-05-15

MLflow is an open-source platform used by data scientists to manage the machine learning lifecycle, including experiment tracking and model deployment. A security flaw allows unauthorized users to bypass login requirements when the server is configured with basic authentication. This could allow an attacker to remotely submit or cancel machine learning jobs, view sensitive results, and corrupt experiment data, potentially disrupting research and development operations.

Technologies: [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-2652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2652 being exploited in the wild.

**How severe is CVE-2026-2652?** High severity, with a CVSS score of 8.6, published 15 May 2026.

**Which products and versions are affected?** mlflow (PyPI) < 3.11.0, ECOSYSTEM:introduced=0,fixed=3.10.0, ECOSYSTEM:introduced=0,fixed=3.11.0.

**Is there a fix for CVE-2026-2652?** Yes. mlflow (PyPI): upgrade to 3.10.0, 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2652 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2652?** Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mlflow (PyPI): upgrade to 3.10.0, 3.11.0 or later

  ```sh
  pip install "mlflow>=3.11.0"
  ```


## Technical details

An authentication bypass exists in MLflow versions prior to 3.11.0 due to an architectural mismatch between Flask and FastAPI authentication mechanisms. When MLflow is served via uvicorn (ASGI) with '--app-name basic-auth', the FastAPI permission middleware incorrectly restricts authentication enforcement to '/gateway/' routes only. The '_find_fastapi_validator()' function fails to validate other paths, leaving the Job API ('/ajax-api/3.0/jobs/*') and OpenTelemetry trace ingestion API ('/v1/traces') unprotected. A remote, unauthenticated attacker can exploit this to perform administrative actions such as job submission, cancellation, and data injection. The issue is resolved in version 3.11.0 (noting some documentation mentions 3.10.0, the package metadata specifies 3.11.0).

## Affected products

- MLflow MLflow < 3.11.0

## Identifiers

- CVE-2026-2652
- GHSA-75cm-x2w3-8mgf
- PYSEC-2026-2221

## Timeline

- 2026-05-15: advisory: Initial disclosure via GitHub Advisory and NVD
- 2026-05-21: other: Advisory updated and reviewed

## References

- [https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa](https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa)
- [https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756](https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756)

## Related threats

- [MLflow arbitrary code execution in third-party scorer deserialization](https://junglewise.ai/threats/cve-2026-116692-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow credential leak in CrewAI autolog](https://junglewise.ai/threats/cve-2026-116691-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow path traversal in prompt model version artifact access](https://junglewise.ai/threats/cve-2026-116690-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow unsafe deserialization in scorer endpoints](https://junglewise.ai/threats/cve-2026-115886-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow FileStore path traversal in trace storage](https://junglewise.ai/threats/cve-2026-53995-mlflow-3-17-1-and-earlier-contains-a-path-traversal-vulnerability)