CVE-2026-0545

描述

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.

如何修補 CVE-2026-0545

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2026-0545 正在被利用嗎?

低 — EPSS 為 4.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, <= 3.10.1

CVSS 分數

參考連結(5)

• ADVISORYgithub.com/advisories/GHSA-7qhf-v65m-g5f3
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-0545
• PATCHgithub.com/mlflow/mlflow
• PATCHpypi.org/project/mlflow
• WEBhuntr.com/bounties/b2e5b028-9541-4d29-8703-a76f1a3734d8