Testbed/MLflow-CVE-2026-2635

[sanjaymahajan14]

Added testbed for MLflow-CVE-2026-2635. Please review it.

[robert-doyensec]

Hi @sanjaymahajan14 , the testbed uses two different versions of MLFlow, but also change the password in the config files -- I think only one of these changes should be necessary since the vulnerability is default credentials. The CVE information available isn't very clear about what the fix was for this specific vulnerability and appears to reference information for a different vulnerability, so I'm not completely sure.

Also, the vulnerability doesn't appear to be patched in the 2.11.0 version that is in the docker-compose file. When I removed your environment variables and config file mount, the vulnerability was present in both versions. The security advisory at GHSA-gq3w-7jj3-x7gr says it's patched in 3.8.0rc0, but I'm not sure since the docker compose file would need to be changed more to work with that version.

Could you determine which version actually resolves the vulnerability and how (for example, if they make an automatic random password now, or just rely on users to not use the configuration file)?