2 lines
3.8 KiB
JSON
2 lines
3.8 KiB
JSON
{"affected":[{"affectedData":[{"product":"mlflow/mlflow","vendor":"mlflow","versions":[{"lessThan":"3.10.0","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"security@huntr.dev"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*","matchCriteriaId":"C8CA51FC-A1F9-4F91-B400-F7C9691394E0","versionEndExcluding":"3.10.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0."},{"lang":"es","value":"Una vulnerabilidad en las versiones 3.9.0 y anteriores de mlflow/mlflow permite el acceso no autenticado a ciertas rutas de FastAPI cuando el servidor se inicia con la autenticación habilitada (’--app-name basic-auth’) y se sirve a través de uvicorn (ASGI). El middleware de permisos de FastAPI solo aplica la autenticación en las rutas ’/gateway/’, dejando desprotegidas otras rutas como la API de trabajos (’/ajax-api/3.0/jobs/*’) y la API de ingesta de trazas de OpenTelemetry (’/v1/traces’). Esto permite a atacantes remotos no autenticados enviar trabajos, leer resultados de trabajos, cancelar trabajos en ejecución e inyectar datos de traza arbitrarios en experimentos. El problema surge de una falta de coincidencia arquitectónica entre los mecanismos de autenticación de Flask y FastAPI, donde la función ’_find_fastapi_validator()’ no logra manejar rutas que no son ’/gateway/’, lo que resulta en una omisión de autenticación completa. Esta vulnerabilidad se corrige en la versión 3.10.0."}],"id":"CVE-2026-2652","lastModified":"2026-11-11T20:10:00.273","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.0"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"security@huntr.dev","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-2652","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-15T13:22:14.645523Z","version":"2.0.3"}}]},"published":"2026-05-15T03:16:23.127","references":[{"source":"security@huntr.dev","tags":["Patch"],"url":"https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa"},{"source":"security@huntr.dev","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756"}],"sourceIdentifier":"security@huntr.dev","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-305"}],"source":"security@huntr.dev","type":"Secondary"}]}
|