18,020 Exposed MLflow Servers Prompt Review of Experiment Tracking Security

·9 views

Researchers found that ZoomEye indexed 18,020 assets matching an MLflow fingerprint on 28 October 2026, though the index does not reveal authentication status or whether a given server is vulnerable. The flaw, tracked as CVE-2026-116690, affects MLflow versions 3.10.0 through 3.16.1 and lets a prompt-tagged model version use a schemeless local path that the server later serves with its own process permissions. An unauthenticated default server could expose remote file reads, and even basic-authentication setups may be reachable by users allowed to create registered models. The fix is available in version 3.17.0, and administrators are advised to verify the running version, review who can create model versions, and audit the credentials the process can access. The guidance stresses that an indexed server should not be presumed compromised, and that incident evidence should come from the server's own logs.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Researcher finds airlock approval bypass in Hermes Agent guardrail, fixed in 0.2.3

A developer testing airlock, a prompt-injection guardrail plugin for Hermes Agent, found that its approval prompts could be skipped when a session ran unattended. In a oneshot run, a simulated agent sent mail contents to a local listener through a terminal command, and neither a prompt nor a block occurred. The cause was that airlock checked global settings while Hermes recorded unattended status within the individual turn. The issue was reported privately and fixed in airlock 0.2.3, which now asks Hermes's own approval logic whether a call can be approved without a human. The fix covers several run modes, including oneshot, yolo, cron, webhook and subagent contexts, and includes an end-to-end test. The author also describes a separate approach that refuses writes from tainted agents instead of asking for approval.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ABLITERAX: an open framework for auditing and ablating LLM refusal representations

ABLITERAX is an open-source research system that locates refusal representations inside large language models and measures their linearity, multi-directionality, and distribution across layers. It performs targeted ablation under capability constraints and uses a held-out evaluation set to check that a drop in refusals does not come at the cost of general reasoning. The project's design stance stresses explicit limits, reporting of failures, and reversible, auditable changes to original checkpoints. Its authors argue that safety in frontier-scale and mixture-of-experts models is distributed across several pathways, so single-direction approaches tend to fail there. The document also specifies an architecture registry that requires verified adapters rather than name-pattern guesses for tensor mapping.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Git Reset vs Revert vs Restore: When to Use Each

The article explains that git reset moves a branch to another commit, git revert adds a new commit that cancels an earlier one, and git restore copies file contents without changing history. The main deciding factor is whether others have already pulled the commit: if they have, revert is the safer choice, and if not, reset can be used. The author tested all three commands on Git 2.56.0 in a scratch repository, including a push to a bare remote. The guide covers the three reset modes (soft, mixed, and hard) and how each treats staged and unstaged changes. It also shows how to undo a last commit while keeping the work and how to recover after a hard reset.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SparkCat malware scans phone photos for crypto seed phrases and steals funds

Kaspersky has identified a malware called SparkCat that hides inside ordinary-looking applications, including some distributed through official app stores. It scans the photo gallery for seed phrases, which are often stored as screenshots or photos, and sends them to attackers. Once an attacker has a seed phrase, the victim's cryptocurrency can be drained. The article advises keeping seed phrases offline in a secure, durable location, avoiding storing them on connected devices, and considering hardware wallets with a screen rather than software wallets on phones or computers. The piece was originally published on 0xalert.com, a crypto asset protection service that promotes its own paid auditing and alert offerings.

0 comments Read more at DEV Community