Fehlende Authentifizierung für kritische Funktion in mlflow/mlflow

This vulnerability presents a significant risk of remote code execution. An attacker can leverage the unsecured /ajax-api/3.0/jobs/* endpoints to submit arbitrary jobs, potentially triggering actions with elevated privileges. If the allowlisted job functions include shell execution or filesystem modifications, an attacker could gain complete control over the MLflow server and potentially the underlying system. The lack of authentication means any network client can exploit this, significantly broadening the attack surface. This vulnerability is particularly concerning given the increasing adoption of MLflow for machine learning workflows, which often involve sensitive data and critical infrastructure.

Organizations deploying MLflow in production environments, particularly those with job execution enabled and exposed to external networks, are at significant risk. Shared hosting environments where multiple users share the same MLflow instance are also particularly vulnerable, as an attacker could potentially compromise the entire environment.

• python / server:

import requests
import json

url = 'http://your-mlflow-server/ajax-api/3.0/jobs/'

try:
    response = requests.get(url, timeout=5)
    response.raise_for_status()
    if response.status_code == 200:
        print('Potential vulnerability: Unauthenticated access to job endpoints.')
    else:
        print('Endpoint access restricted (expected).')
except requests.exceptions.RequestException as e:
    print(f'Error connecting to endpoint: {e}')

• linux / server:

journalctl -u mlflow -f | grep -i "unauthorized access"

• generic web:

curl -I http://your-mlflow-server/ajax-api/3.0/jobs/ | grep -i 'HTTP/1.1 200 OK'

1. 2026-04-03Disclosure

   disclosure

1. Reserviert2026-01-01
2. Veröffentlicht2026-04-03
3. Geändert2026-04-08
4. EPSS aktualisiert2026-04-11

The primary mitigation is to upgrade MLflow to a version containing the fix. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider disabling job execution (MLFLOWSERVERENABLEJOBEXECUTION=false) as a temporary workaround. Additionally, carefully review and restrict the allowlisted job functions to minimize the potential impact of any successful exploitation. Implementing a Web Application Firewall (WAF) with rules to block unauthorized access to the /ajax-api/3.0/jobs/* endpoints can provide an additional layer of defense. After upgrade, confirm by attempting to submit a job without authentication and verifying that access is denied.