The vulnerability in mlflow/mlflow involves missing authentication for critical FastAPI job endpoints when basic-auth is enabled. Specifically, if the environment variable MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true and any job function is allowlisted, these endpoints do not enforce authentication or authorization, allowing unauthenticated network clients to interact with job functions. This bypasses basic-auth protection entirely. The impact includes potential unauthenticated remote code execution if allowed jobs perform sensitive operations such as shell commands or filesystem modifications. Even if remote code execution is not possible, the lack of authentication permits job spam, denial of service, and exposure of job results.

The vulnerability allows unauthenticated attackers to fully control job submission and management endpoints, bypassing basic authentication. This can lead to remote code execution if jobs perform privileged actions, or cause denial of service and data exposure through job manipulation. The CVSS score of 9.1 reflects the high impact on confidentiality and integrity with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable job execution (set MLFLOW_SERVER_ENABLE_JOB_EXECUTION=false) or avoid allowlisting any job functions. Additionally, restrict network access to the affected endpoints to trusted clients only. Monitor vendor communications for official patches or updates.