CVE-2026-0545 - Vulnerability Analysis

Overview

mlflow/mlflow latest version contains an authentication bypass caused by unprotected FastAPI job endpoints under /ajax-api/3.0/jobs/* when basic-auth is enabled, letting unauthenticated network clients submit and manage jobs, exploit requires job execution enabled and allowlisted job functions.

Severity & Score

Impact

Unauthenticated attackers can execute jobs remotely, potentially leading to remote code execution, denial of service, or data exposure.

Mitigation

Update to the latest version with fixed authentication enforcement on job endpoints.

References

• https://huntr.com/bounties/b2e5b028-9541-4d29-8703-a76f1a3734d8

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 4, 2026

🔴 CVE-2026-0545 - Critical (9.1) In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution i... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0545/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner