CVE-2026-0545: 
Wolfi vulnerability analysis and mitigation

CVE-2026-0545 is a critical missing authentication vulnerability in MLflow's FastAPI job endpoints (/ajax-api/3.0/jobs/*) that allows unauthenticated network clients to submit, read, search, and cancel jobs, completely bypassing the basic-auth app when enabled. It affects mlflow/mlflow versions up to and including 3.10.1 (latest at time of disclosure). The vulnerability was published on April 3, 2026, with the GitHub Advisory (GHSA-7qhf-v65m-g5f3) updated on April 6, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 9.1 (Critical) per the GitHub Advisory (GitHub Advisory).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function): the FastAPI routes under /ajax-api/3.0/jobs/* are not registered within MLflow's basic-auth middleware, meaning authentication checks are never applied to these endpoints (GitHub Advisory). Exploitation requires two preconditions: the server must have job execution enabled (MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true) and at least one job function must be allowlisted. When these conditions are met, any network-reachable client can send unauthenticated HTTP requests to the job endpoints to trigger job execution, retrieve results, or cancel running jobs. If allowlisted jobs perform privileged operations such as shell commands or filesystem modifications, this directly enables unauthenticated remote code execution (GitHub Advisory, Huntr Bounty).

Successful exploitation can result in unauthenticated remote code execution if allowlisted job functions perform privileged actions such as shell execution or filesystem changes, leading to full system compromise (GitHub Advisory). Even without privileged jobs, attackers can abuse the authentication bypass to flood the server with job submissions (denial of service), access sensitive data exposed in job results, or disrupt ML workflows. The vulnerability affects the confidentiality and integrity of the MLflow server and any data or systems it can reach, with potential for lateral movement if the server has access to broader infrastructure (GitHub Advisory).

A proof-of-concept exploit reference is available via the Huntr bug bounty platform, though the page content was not fully accessible for verification (Huntr Bounty). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.24% per Feedly data, though the GitHub Advisory reports a notably higher 10.825% (94th percentile), indicating elevated exploitation probability relative to other CVEs (GitHub Advisory). The vulnerability is not currently listed in the CISA KEV catalog. Nuclei detection templates have been developed and merged into the ProjectDiscovery nuclei-templates repository, facilitating automated scanning.

1. Reconnaissance: Identify internet-facing or network-accessible MLflow servers using tools like Shodan, Censys, or Nuclei templates targeting MLflow instances running version ≤ 3.10.1.
2. Verify configuration: Confirm that the target MLflow server has MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true set and that the basic-auth plugin is enabled (e.g., by observing login prompts on other endpoints while job endpoints remain open).
3. Probe job endpoints: Send an unauthenticated HTTP GET or POST request to /ajax-api/3.0/jobs/ (e.g., a job list or search endpoint) without any Authorization header. A successful response (HTTP 200) confirms the authentication bypass.
4. Enumerate allowlisted jobs: Use the search/list endpoint to identify available job functions that are allowlisted on the server.
5. Submit malicious job: If a privileged job function (e.g., one that executes shell commands or modifies the filesystem) is allowlisted, craft and submit a job payload via an unauthenticated POST to /ajax-api/3.0/jobs/submit to trigger remote code execution.
6. Retrieve results: Poll the job status and results endpoints unauthenticated to retrieve output, exfiltrate data, or confirm code execution (GitHub Advisory, Huntr Bounty).

• Network: Unauthenticated HTTP requests (no Authorization header) to /ajax-api/3.0/jobs/* endpoints from external or unexpected IP addresses; unusual volume of POST requests to job submission endpoints.
• Logs: MLflow access logs showing requests to /ajax-api/3.0/jobs/ endpoints without authentication tokens or session cookies; repeated job submission requests from a single IP in a short timeframe (job spam pattern).
• Process: Unexpected child processes spawned by the MLflow server process (e.g., /bin/bash, sh, python, curl, wget) if privileged job functions are exploited for RCE.
• File System: New or modified files in the MLflow server's working directory or system directories created by the MLflow service account; unexpected scripts or binaries appearing on the host.
• Application: Unusual job entries in the MLflow job database submitted by unknown or anonymous principals; job results containing system command output or unexpected data.

As of the advisory publication, no patched version of MLflow has been released (all versions ≤ 3.10.1 are affected); users should monitor the GitHub Advisory for patch availability and upgrade immediately when a fix is released. As an interim workaround, disable job execution entirely by setting MLFLOW_SERVER_ENABLE_JOB_EXECUTION=false. Additionally, restrict network access to the MLflow server at the firewall or network perimeter level to prevent unauthenticated external clients from reaching the /ajax-api/3.0/jobs/* endpoints. Review and minimize the allowlist of job functions, removing any that perform privileged operations such as shell execution or filesystem modifications (GitHub Advisory).

The vulnerability was discovered and reported through the Huntr AI bug bounty platform and assigned a critical severity rating by both NVD and the GitHub Advisory Database (GitHub Advisory, Huntr Bounty). The ProjectDiscovery community responded by developing and merging Nuclei detection templates for automated scanning of this vulnerability. Red Hat also tracked the CVE via their security advisory system. No major vendor statements or notable researcher commentary beyond the advisory and bounty disclosure have been identified.