PyPI/mlflow CVE-2026-2652: high 8.6, EPSS 20.78%
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
Action: Upgrade mlflow to 3.10.0 or later.
pip install mlflow==3.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.10.0 | - |
Fixed versions
| 3.10.0 |
Sources
- osv: PYSEC-2026-2221
- https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa
- https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756
- https://github.com/advisories/GHSA-75cm-x2w3-8mgf
CVE-2026-2652 · published · modified · JSON