Testbed/MLflow-CVE-2026-2635

[sanjaymahajan14]

Added testbed for MLflow-CVE-2026-2635. Please review it.

[robert-doyensec]

Hi @sanjaymahajan14 , the testbed uses two different versions of MLFlow, but also change the password in the config files -- I think only one of these changes should be necessary since the vulnerability is default credentials. The CVE information available isn't very clear about what the fix was for this specific vulnerability and appears to reference information for a different vulnerability, so I'm not completely sure.

Also, the vulnerability doesn't appear to be patched in the 2.11.0 version that is in the docker-compose file. When I removed your environment variables and config file mount, the vulnerability was present in both versions. The security advisory at GHSA-gq3w-7jj3-x7gr says it's patched in 3.8.0rc0, but I'm not sure since the docker compose file would need to be changed more to work with that version.

Could you determine which version actually resolves the vulnerability and how (for example, if they make an automatic random password now, or just rely on users to not use the configuration file)?

[sanjaymahajan14]

Hi @robert-doyensec ,
You are completely right on both counts. Changing the password in the configuration file masked the underlying behavior, and the fix was indeed introduced in MLflow 3.8.0 (first staged in 3.8.0rc0), not 2.11.0.
How the Vulnerability Was Resolved:
MLflow < 3.8.0 (e.g., v2.10.0): The basic-auth app silently seeded the database with static hard-coded credentials (admin:password) whenever the service started without user-defined credentials.
MLflow ≥ 3.8.0: completely removed the silent static credential fallback. MLflow no longer creates default admin:password credentials on initialization; instead, it enforces explicit credential provisioning. Out-of-the-box requests using admin:password are strictly rejected with 401 Unauthorized.

Updated Testbed (docker-compose.yml):
All external .ini mounts and password overrides have been removed. Both containers now run purely on out-of-the-box settings to test version-level behavior directly: