Authentication Bypass

mlflow is vulnerable to Authentication Bypass. The vulnerability is due to a bypass in both the mlflow server and mlflow UI around MLFlow’s implementation of basic authentication. This flaw allows an unauthenticated malicious user to create a user/credential set using the 2.0 REST API. Consequently, an attacker can exploit this vulnerability to log into MLFlow as a legitimate user, providing unauthorized access to models, experiments, and artifacts within the system.