MLflow Default Password Authentication Bypass Vulnerability

A vulnerability in MLflow allows remote attackers to bypass authentication on affected installations. The issue arises from hard-coded default credentials in the basic_auth.ini file, enabling attackers to authenticate as an administrator and execute arbitrary code. This vulnerability does not require authentication to exploit.

Impact

Exploitation of this vulnerability allows for authentication bypass, with the potential for executing arbitrary code in the context of the administrator.

Remediation

MLflow has released an update to address this vulnerability. Users should refer to the MLflow GitHub repository for details on the update.