CVE-2026-2635: Critical MLflow Default Credential Flaw Enables Instant Admin Takeover and Full System Compromise

MLflow – Default Credentials Leading to Administrative Takeover

CVE ID: CVE-2026-2635
Product: MLflow
Vulnerability Type: Use of Default Credentials (Authentication Bypass)
CWE: CWE-1393 – Use of Default Password
CVSS v3.1 Score: 9.8 (Critical)
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Impact: High (Confidentiality, Integrity, Availability)
Exploitability: High
Exploit Availability: No widely published weaponized exploit; trivial to reproduce manually

Technical Description

In vulnerable MLflow deployments, the built-in basic authentication mechanism relied on a configuration file (basic_auth.ini) that contained default administrative credentials. When deployed without modifying these credentials, the system accepted them as valid for administrative login.

Because authentication was performed against static values defined in configuration, any attacker with network access to the MLflow tracking server could authenticate as an administrator using default credentials.

Once authenticated, administrative-level permissions were granted across the MLflow application interface and API endpoints. This allowed:

Access to experiment metadata and run details
Downloading or modifying model artifacts
Registering and promoting models
Altering experiment configurations
Uploading malicious artifacts
Potential execution of arbitrary code via model serving or artifact manipulation

The vulnerability effectively removed authentication as a barrier. No exploit chaining or complex payload was required. The condition was triggered simply by logging in with the default credentials.

Root Cause Analysis

The issue stemmed from:

Static default credentials being present in configuration
No forced password change during first startup
No validation to ensure default credentials were replaced
Acceptance of insecure authentication configuration in production environments

The design assumed administrators would manually update credentials before deployment. That assumption introduced risk in real-world environments.

Impact Assessment

If exploited, the following consequences were possible:

1. Full Administrative Control

An attacker could:

Create, delete, or modify experiments
Access all stored model artifacts
Change system settings

2. Model Supply Chain Tampering

Malicious models or artifacts could be uploaded. Downstream systems consuming those artifacts could execute attacker-controlled code.

3. Remote Code Execution (Indirect)

While not a direct RCE vulnerability, code execution could be achieved by:

Registering a malicious model
Triggering model serving
Injecting manipulated artifacts

Execution would occur under the MLflow service account context.

4. Data Exfiltration

Sensitive:

API keys
Access tokens
Model intellectual property
Dataset paths

could be retrieved.

5. Infrastructure Pivoting

If MLflow had access to:

S3 buckets
Databases
Kubernetes clusters
Internal APIs

the attacker could move laterally.

Exploitation Scenario (Educational)

The attack required only:

Identify exposed MLflow server
Access login page or API endpoint
Submit default admin credentials
Receive authenticated session token
Use API to enumerate or manipulate resources

Educational Authentication Request

POST /login HTTP/1.1
Host: target-mlflow-server
Authorization: Basic YWRtaW46cGFzc3dvcmQ=

(Base64 decodes to admin:password – example for defensive understanding.)

If successful, HTTP 200 response with session cookie would be returned.

No exploit code was required. Standard HTTP tools were sufficient.

Indicators of Compromise (IoCs)

Unexpected successful login using “admin” account
Login from unfamiliar IP addresses
Multiple failed attempts followed by success
Unusual artifact uploads
Sudden creation of new experiments
Model registry modifications
Unexpected outbound network connections from MLflow host

Log Sources for Detection

Detection should focus on:

Web server access logs (Nginx, Apache, reverse proxy)
MLflow application logs
Authentication logs
Artifact storage logs (S3, MinIO)
Kubernetes audit logs
System process execution logs
Container runtime logs

Detection Queries

Splunk Detection Query – Basic Authentication Usage

index=web sourcetype=nginx_access OR sourcetype=apache_access
"Authorization: Basic"
| eval decoded=base64decode(replace(Authorization,"Basic ",""))
| search decoded="admin:*"
| table _time, src_ip, uri, status, decoded

Splunk Detection – Suspicious Admin Activity

index=mlflow_logs user="admin"
| stats count by src_ip, action, endpoint
| where count > 5

Elastic (KQL) – Detect Basic Auth Usage

http.request.headers.authorization : "Basic *"
and user.name : "admin"

Elastic – Artifact Upload Monitoring

event.dataset : "mlflow"
and http.request.method : "POST"
and url.path : "/api/2.0/mlflow/artifacts/*"

Microsoft Sentinel (KQL)

AzureDiagnostics
| where RequestUri_s contains "/mlflow"
| where RequestHeaders_s contains "Authorization: Basic"

AWS CloudWatch Insights

fields @timestamp, @message
| filter @message like /Authorization: Basic/
| filter @message like /admin/
| sort @timestamp desc

Behavioral Detection Strategy

Even if credentials were changed, watch for:

Sudden increase in experiment enumeration calls
Burst download of artifacts
Registration of new models outside business hours
Execution of model serving endpoints after admin login

Correlating login → artifact upload → model registration within short time window is high-risk behavior.

Network Detection

IDS/IPS monitoring can look for:

HTTP Authorization header with Base64 strings
Decoded strings containing common default usernames
Direct exposure of MLflow on public internet (port scanning detection)

Forensic Collection Checklist

If compromise is suspected:

Preserve web server logs
Export MLflow run history
Snapshot artifact repository
Capture system process list
Collect container runtime metadata
Dump authentication database
Check for newly created system users

Mitigation and Remediation

Immediate Actions

Change all default credentials immediately
Restrict MLflow to internal network only
Implement firewall allowlisting
Disable basic authentication if possible

Long-Term Controls

Use enterprise authentication (OIDC / SAML)
Enforce password rotation policy
Implement network segmentation
Enable centralized logging
Apply least privilege IAM policies
Regularly audit MLflow configuration files

Patch and Upgrade

The issue has been addressed in updated MLflow releases.

Upgrade MLflow to the latest secure version available from the official repository.

Official MLflow Repository:
https://github.com/mlflow/mlflow

Review release notes and upgrade to the version containing the fix for CVE-2026-2635.

Risk Rating Summary

This vulnerability should be considered critical because:

It requires no authentication
It requires no user interaction
It can be exploited remotely
It leads to full administrative takeover
It can result in data theft and code execution

Organizations running MLflow in production environments, especially internet-facing instances, should treat this as an urgent remediation priority.