ZDI-26-111: MLflow Default Password Bypass Vulnerability

TL;DR

A critical vulnerability in MLflow allows unauthorized access via default password, impacting system security and integrity.

What happened

['MLflow installations are vulnerable to default password bypass', 'Remote attackers can exploit this without authentication']

Why it matters for ops

['Default passwords often remain unchanged, exposing systems to threats', 'Exploitation requires minimal effort due to no auth requirement']

Mitigation

• Update to the latest version of MLflow
• Immediately change default passwords if applicable

Action items

• Review system configurations for default password usage
• Patch affected systems as soon as possible

Detection IOCs

• Unexplained administrative access logs
• Attempts to use default credentials in MLflow

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-111/