Loading story…
MLflow disclosed and patched multiple high-severity vulnerabilities affecting deployments of the MLflow platform, including an authentication bypass due to default credentials in basic_auth.ini tracked as CVE-2026-2635 (ZDI-26-111). The issue allows unauthenticated remote attackers to bypass authentication and potentially execute arbitrary code with administrator context; ZDI scored it CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and credited the finding to Peter Girnus (@gothburz) via Trend Micro’s Zero Day Initiative (ZDI).
A separate MLflow Tracking Server flaw, CVE-2026-2033, enables directory traversal leading to remote code execution via improper validation of user-supplied artifact file paths in the artifact handler. Exploitation requires no authentication and can result in code execution in the context of the MLflow service account. Both issues reference the same upstream remediation in MLflow (https://github.com/mlflow/mlflow/pull/19260) and were published through ZDI advisories (including ZDI-26-111 for CVE-2026-2635 and ZDI-26-105 for CVE-2026-2033), indicating coordinated fixes are available and should be prioritized for exposed MLflow instances.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A ProjectDiscovery nuclei-templates pull request added detection logic for CVE-2026-2635. The template tested whether internet-exposed MLflow instances still accepted the default admin credentials admin:password1234 and confirmed administrative access through the users API.
A separate MLflow vulnerability, CVE-2026-2033, was published describing a directory traversal flaw in the tracking server artifact handler. The issue could be exploited remotely without authentication to execute arbitrary code in the service account context.
Zero Day Initiative publicly disclosed ZDI-26-111 / CVE-2026-2635, describing a high-severity MLflow authentication bypass caused by hard-coded default credentials. The advisory stated remote unauthenticated attackers could gain access and potentially achieve arbitrary code execution in the administrator context.
Before public disclosure, MLflow released an update addressing the default-password authentication bypass vulnerability tracked as CVE-2026-2635. References to an MLflow GitHub pull request indicate the vendor made code changes to remediate the issue.
Trend Micro’s Zero Day Initiative reported ZDI-CAN-28256, later assigned CVE-2026-2635, to the MLflow vendor. The flaw involved hard-coded default credentials in MLflow’s basic_auth.ini file that could allow authentication bypass and lead to code execution as an administrator.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-64849**, a critical unauthenticated server-side request forgery flaw in MLflow’s webhook delivery logic, to steal credentials and sensitive data from exposed tracking server deployments. The vulnerability affects MLflow versions prior to **`3.15.0`** and abuses the default-enabled model-registry webhooks API, allowing crafted webhook requests to reach internal services and cloud metadata endpoints. Researchers reported exploitation within hours of the CVE being assigned, with attempts to extract secrets from addresses including **`127.0.0.1`** and **`169.254.169.254`**. The flaw stems from MLflow validating a webhook URL and then re-resolving or following redirect targets during delivery, enabling DNS rebinding or redirect-based access to non-public destinations. Successful exploitation can expose highly privileged credentials, including AWS IAM role credentials tied to EC2 instances or Kubernetes nodes, and may provide access to internal databases, configurations, and administrative tools. The vulnerability carries a **CVSS 9.3** rating, and MLflow **`3.15.0`** addresses it by tightening destination validation and blocking non-global IP addresses; defenders are being urged to patch immediately and investigate whether secrets or cloud credentials were exposed.
Aug 20, 2026
High-severity vulnerabilities in **MLflow** and **BentoML** exposed AI model deployment workflows to arbitrary code execution on host systems through malicious model packages. In **CVE-2025-15379**, MLflow's model serving container initialization code improperly interpolated dependency data from a model artifact's `python_env.yaml` into a shell command inside `_install_model_dependencies_to_env()` when `env_manager=LOCAL` was used, creating a command injection path. The issue affects **MLflow 3.8.0** and was fixed in **3.8.2**; the flaw carries **CWE-77** and a **CVSS 9.8**-equivalent vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`. In **CVE-2026-35044**, BentoML's `generate_containerfile()` function rendered user-supplied `dockerfile_template` files with an unsandboxed **Jinja2** environment and the `jinja2.ext.do` extension, allowing a malicious bento archive to execute arbitrary Python code on the host when a victim ran `bentoml containerize`. The vulnerability affects versions before **1.4.38** and was fixed in **1.4.38**; it is classified as **CWE-1336** with a **CVSS 8.8** vector of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. Together, the disclosures highlight a growing risk in MLOps tooling where importing or deploying untrusted model artifacts can bypass expected isolation and compromise build or serving infrastructure.
Jun 29, 2026
Flowise disclosed a critical remote code execution flaw, tracked as **`CVE-2026-56274`**, affecting versions before **`3.1.2`** in the Custom MCP Server feature. The vulnerability stems from multiple OS command injection paths in **`validateCommandFlags`** and **`validateArgsForLocalFileAccess`**, allowing attackers to configure a malicious MCP server and execute arbitrary commands on the Flowise host. The issue is rated **CVSS 9.9** and is remotely exploitable. Advisories describe three bypass techniques: an incomplete Docker argument blocklist that permits **`docker build`** with a remote URL, an **`npx`** blocklist bypass where **`--yes`** is allowed even though **`-y`** is blocked, and a Unix path validation weakness that lets paths beginning with **`//`** evade local file access checks for **`node`**. Exploitation requires any Flowise account role or API access with view and update permissions for chatflows. Organizations were urged to upgrade to **`Flowise 3.1.2`** or later, review MCP server configurations, and restrict chatflow management permissions.
Jun 29, 2026