The vulnerability in mlflow/mlflow (<=3.9.0) arises because the FastAPI permission middleware enforces authentication only on /gateway/ routes, leaving other routes such as /ajax-api/3.0/jobs/* and /v1/traces unprotected when basic authentication is enabled. This architectural mismatch between Flask and FastAPI authentication mechanisms causes the _find_fastapi_validator() function to bypass authentication checks on these routes. As a result, unauthenticated attackers can remotely perform sensitive actions including job submission, job result retrieval, job cancellation, and injection of arbitrary trace data into experiments. The vulnerability is addressed in mlflow version 3.10.0.

The vulnerability allows unauthenticated remote attackers to bypass authentication controls and interact with critical API endpoints. Attackers can submit jobs, access job results, cancel running jobs, and inject arbitrary telemetry data, potentially compromising the integrity and confidentiality of experiment data and workflows. The CVSS score of 8.6 reflects a high impact with low attack complexity and no required privileges or user interaction.

This vulnerability is fixed in mlflow version 3.10.0. Users should upgrade to version 3.10.0 or later to remediate this issue. Since no official patch link or advisory is provided, verify the upgrade availability from the official mlflow project resources. Until upgraded, restrict access to the affected API endpoints through network controls or disable the affected routes if possible. Patch status is not yet confirmed via vendor advisory; check official mlflow channels for the latest remediation guidance.