MLflow: basic-auth not enforced on FastAPI routes, leaving Job API and trace ingestion open

Impact

When MLflow is started with --app-name basic-auth and served through uvicorn, the FastAPI permission middleware only checks /gateway/ routes. The Job API (/ajax-api/3.0/jobs/*) and OpenTelemetry trace ingestion (/v1/traces) answer without authentication. An unauthenticated attacker can submit jobs, read job results, cancel running jobs and inject made-up trace data into experiments. Operators who switched on basic-auth to protect a shared MLflow instance get no protection on these routes. The record does not say what a submitted job can run, so the full reach of job submission depends on the deployment.

Who can reach it

Anyone who can reach the MLflow server over the network. No authentication is needed. Only servers running the basic-auth app under uvicorn (ASGI) are affected.

What to do

Upgrade MLflow to 3.10.0 and restart the tracking server. Until then, keep the server off untrusted networks, or put an authenticating reverse proxy in front of every route, not just /gateway/.

References

Related entries

• ONNX: Security-control bypass through 1.20.1CVE-2026-28500 · ONNXHigh
• ONNX (`ExternalDataInfo`): Security control bypass in external-data path handlingCVE-2026-34445 · ONNX (`ExternalDataInfo`)High
• JupyterLab: saved HTML cell output can run arbitrary JupyterLab commands on one user clickCVE-2026-42557 · JupyterLab (HTML sanitizer / CommandLinker command dispatch)High
• LocalAI (`/models/apply`): Unauthenticated SSRF fetching arbitrary internal URLsCVE-2026-59707 · LocalAI (`/models/apply`)High
• Text Generation Inference (TGI): SSRF in the OpenAI-compatible multimodal chat endpointCVE-2026-63086 · Text Generation Inference (TGI)High
• MLflow: a crafted model artifact runs arbitrary code when the model is loadedCVE-2026-79721 · MLflow (model artifact loading)High