Description
未授权访问漏洞是指攻击者未经过身份验证或绕过身份验证机制，就能够访问系统资源或执行敏感操作的安全漏洞。这种漏洞可能导致敏感信息泄露、数据篡改、服务中断等严重后果，给系统安全性带来极大威胁。
MLflow 默认没有认证功能，导致任意用户都可以进入系统进行操作，详情参考：https://avd.aliyun.com/detail?id=AVD-2023-1660217×tamp__1384=n4%2BxnDBDRDyDgDGOxBqtoQ0QkYwDTWYUeD
MLflow 未授权访问漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.tenablecloud.cn/plugins/was/114324
https://www.secevery.com/toBugInfo?id=1864254543611346945
https://security.zone.ci/aliyun/ali_highrisk/11430.html
https://www.tenable.com/plugins/was/114324
https://www.acunetix.com/vulnerabilities/web/unrestricted-access-to-mlflow/
https://github.com/advisories/GHSA-75cm-x2w3-8mgf
https://nvd.nist.gov/vuln/detail/CVE-2025-11200
https://www.sentinelone.com/vulnerability-database/cve-2026-2635/