{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:33.525Z","products":["mlflow"],"actNowTotal":0,"results":[{"query":"mlflow","matched":1,"actNow":0,"events":[{"id":"early-cve-2026-2652","url":"https://securitythreatpulse.com/events/early-cve-2026-2652","title":"Mlflow: attackers can get in without a password","verdict":"watch","verdictReason":"Attack attempts are confirmed, with no confirmed exploitation yet.","tier":null,"rankScore":2,"rankWhy":["Ready-made attack tools are public.","The first report is 20 days old."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"none"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-2652"],"vendor":"mlflow","product":"mlflow/mlflow","affectedProducts":[{"kind":"direct","slug":"mlflow/mlflowmlflow","vendor":"Mlflow","product":"Mlflow/mlflow","evidence":["cna","cpe"],"vendorKey":"mlflow","productKey":"mlflowmlflow"}],"category":{"id":"developer","label":"Developer tools","why":"It holds source code and the keys used to build and ship software.","doThis":"Patch it. If it faced the internet, change the keys and passwords stored in it."},"summary":"A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI).","cvss":8.6,"epss":0.20783,"exploitMaturity":"weaponized","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-10-22T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-10-24T23:23:07.997Z"}]}]}