Authentication Bypass Vulnerability in MLflow from Databricks
CVE-2026-2635

9.8CRITICAL

Key Information:

Vendor

Mlflow

Status
Mlflow
Vendor
CVE Published:
20 February 2026

What is CVE-2026-2635?

A significant security flaw exists in MLflow due to the presence of hard-coded default credentials within the basic_auth.ini file. This vulnerability enables remote attackers to bypass authentication without any prior validation, potentially leading to unauthorized access and the execution of arbitrary code in the context of an administrative user. Organizations using MLflow should take immediate action to change these default credentials to mitigate any potential risk.

Affected Version(s)

MLflow 3.4.0

References

https://www.zerodayinitiative.com/advisories/ZDI-26-111/
x_research-advisory
https://github.com/mlflow/mlflow/pull/19260
vendor-advisory

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.