GHSA-gq3w-7jj3-x7gr · Severity: critical · Ecosystem: pip — MLflow Use of Default Password Authentication Bypass Vulnerability
MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.
Conclusion & alert: CVE-2026-2635 is rated Moderate Risk (60.5/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 1.13%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 1.52% | 1.13% | -0.39% |
| 2 | 2026-05-25 | 1.08% | 1.52% | +0.43% |
| 3 | 2026-04-15 | — | 1.08% | — |
Full EPSS history (9 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.0 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
GHSA-gq3w-7jj3-x7gr · Severity: critical · Ecosystem: pip — MLflow Use of Default Password Authentication Bypass Vulnerability
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||