MLflow - Unauthenticated Authentication Bypass via Default Credentials in basic_auth.ini
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2026-2635. PoCs published by arif-s3d0, exploitintel.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-2635, which leverages MLflow's default credentials and pickle deserialization to achieve unauthenticated remote code execution. The exploit automates the process of authenticating, discovering model metadata, crafting a malicious pickle payload, and registering it as a new model version to trigger RCE.
Description
MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.
Exploits (2)
This repository contains a functional exploit for CVE-2026-2635, which leverages MLflow's default credentials and pickle deserialization to achieve unauthenticated remote code execution. The exploit automates the process of authenticating, discovering model metadata, crafting a malicious pickle payload, and registering it as a new model version to trigger RCE.
This repository contains functional exploit code for CVE-2026-2635, an authentication bypass vulnerability in MLflow due to hardcoded default credentials. The PoC scripts demonstrate authentication with default credentials, admin access confirmation, and backdoor user creation.
References (2)
Related Analysis
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
