Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-19 | 1 | Disclosure1 |
| 2026-02-20 | 1 | Disclosure1 |
| 2026-02-23 | 1 | Disclosure1 |
| 2026-03-18 | 1 | Patch1 |
[ZDI-26-111|CVE-2026-2635] MLflow Use of Default Password Authentication Bypass Vulnerability (CVSS 9.8; Credit: Peter Girnus (@gothburz) of Trend Zero Day Initiative) https://www.zerodayinitiative.com/advisories/ZDI-26-111/
Post summary
The advisory announces CVE-2026-2635, a high-severity authentication bypass in MLflow due to use of default passwords, with a CVSS score of 9.8.
An authentication bypass vulnerability (CVE-2026-2635) affects `MLflow` due to default passwords. Review configurations and enforce strong credentials to prevent unauthorized access. #MLflow #AuthBypass #infosec https://www.pulsepatch.io/posts/cve-2026-2635-mlflow-default-password-bypass
Post summary
CVE-2026-2635 is an authentication bypass in MLflow caused by default passwords; remediation involves updating configuration to enforce strong credentials.
🚨 CVE-2026-2635 - CRITICAL MLflow 🤖 AI Summary: Critical auth bypass in MLflow via hard-coded default credentials. Allows remote code execution with admin privileges. ThreatScore: 85/100 🔗 http://threatmonitor.io/cve/CVE-2026-2635 #cybersecurity #infosec #CVE
Post summary
The post announces a critical authentication bypass in MLflow (CVE‑2026‑2635) that permits remote code execution through hard‑coded default credentials, but it does not provide a PoC, exploit, or patch information.
CVE-2026-2635 MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLf… https://www.cve.org/CVERecord?id=CVE-2026-2635
Post summary
CVE‑2026‑2635 identifies an authentication bypass in MLflow due to default passwords allowing remote attackers to gain unauthorized access; no exploit, PoC, or patch details are provided.