Is CVE-2026-0545 actively exploited?

No active exploitation of CVE-2026-0545 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-0545 be exploited remotely?

Yes. CVE-2026-0545 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-0545?

CVE-2026-0545 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-0545

CRITICAL

CVE-2026-0545

CWE-306Published: April 3, 2026· Updated: Apr 7, 2026

9.1

CVSS v3.1

EPSS:0.20%probability of exploitation in 30 daysPercentile:42.0th

Official Description

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.

NVD Source

Technical Analysis

CVE-2026-0545 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.