Description

MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.

INFO

Published Date :

2026-02-20T22:25:03.494Z

Last Modified :

2026-02-27T04:55:48.854Z

Source :

zdi
AFFECTED PRODUCTS

The following products are affected by CVE-2026-2635 vulnerability.

Vendors Products
Mlflow
  • Mlflow
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-2635.

URL Resource
https://github.com/mlflow/mlflow/pull/19260 cve-icon cve-icon
https://www.zerodayinitiative.com/advisories/ZDI-26-111/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact