CVE-2026-2652
2 advisories.
PyPI/mlflow CVE-2026-2652: high 8.6, EPSS 1.41%
MLflow: unauthenticated access to certain FastAPI routes
Action: Upgrade mlflow to 3.11.0 or later.
pip install mlflow==3.11.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.11.0 | - |
Fixed versions
| 3.11.0 |
Sources
- osv: GHSA-75cm-x2w3-8mgf
- https://nvd.nist.gov/vuln/detail/CVE-2026-2652
- https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa
- https://github.com/mlflow/mlflow
- https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756
CVE-2026-2652 · published · modified · JSON
PyPI/mlflow CVE-2026-2652: high 8.6, EPSS 1.41%
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
Action: Upgrade mlflow to 3.10.0 or later.
pip install mlflow==3.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.10.0 | - |
Fixed versions
| 3.10.0 |
Sources
- osv: PYSEC-2026-2221
- https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa
- https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756
- https://github.com/advisories/GHSA-75cm-x2w3-8mgf
CVE-2026-2652 · published · modified · JSON