ClearML exposure review: the Web UI and file server are separate surfaces

ClearML Server provides a web interface for experiments, models, datasets, queues, and agents. It also includes supporting services such as a file server. The two surfaces can have different authentication behavior. A deployment that secures the main web login can still expose artifact files if the supporting service is reachable and configured incorrectly.

The ZoomEye count-only probes for this topic were run on 2026-11-01 with page 1, page size 1, and sub_type=all. app="ClearML" returned 1,131 matches. title="ClearML" returned 1,129. The near-equal totals do not prove that every record is a production instance. They show two fields returning similar-sized candidate sets in this collection.

ClearML's server documentation describes the Web UI and file server as components of the deployment. Its security documentation states that for server versions older than v1.16.0, the file server is not secured even when web login authentication has been configured. The scope of that statement is important. It is a version-specific deployment concern, not a claim that every ClearML result is vulnerable.

Start the review with the deployed version and service topology. Identify the web server, API server, file server, and any reverse proxy paths. Check whether the web UI's authentication cookie protects only the web application or also the file endpoints. A file URL may be generated by the application and served from a different hostname, bucket, or storage gateway.

An artifact can contain model weights, dataset samples, plots, logs, configuration, or source code. Even a file name can reveal project structure. If the file server is publicly reachable, test an unauthenticated request to a nonexistent object and to a known, non-sensitive test object created by the asset owner. Do not enumerate object names or use production content in the test.

The measurements are:

The counts are close, which makes both useful for candidate discovery but does not validate ownership. A result can include documentation, cloud-hosted service pages, or an environment that uses a custom domain. Confirm the hostname through DNS, certificate, and cloud inventory before making a security decision.

For a deployment older than the file-server fix, the safest action is to upgrade to a supported ClearML Server version and re-test. If an immediate upgrade is not possible, restrict the file server to the web server and internal users through network policy or a private ingress. Removing a public DNS record is useful only if no alternate route remains. Test after the change from an external network.

The web login configuration should be reviewed at the same time. Check the login domain, cookie scope, TLS, session lifetime, and password reset path. If the file server is on a different domain, confirm how the browser obtains authorization and whether the design leaks cookies or credentials across hosts. Use the official configuration guidance for the running release instead of copying a domain mapping from an older deployment.

ClearML agents and queues are another control plane. An agent with access to the server may receive tasks that execute code and handle data. Review agent credentials, network paths, resource quotas, and which users can create or modify queues. The web UI may make that work convenient, but an exposed API or agent registration path can be enough to affect the environment.

Do not use a broad search count as an asset inventory. For each candidate, record the query, count, time, hostname, owner confirmation, version, and authentication result. Use the data to prioritize review. Do not access files or workflows that belong to another organization. If the candidate is unknown, report it through the appropriate asset-owner or security process.

The app and title totals also show why a single count is not a quality signal. A product with a strong fingerprint can have a candidate count near a title count, but neither number reveals whether a specific deployment has the file-server configuration described in the security notice. The useful conclusion comes from version, topology, and access tests.

ClearML's documentation provides a clear reason to split the review. Check the web UI and the file server separately. Confirm the version and the intended network boundary. An exposed login page and an unsecured artifact path can coexist in the same deployment, and only an evidence-based check of both surfaces will reveal that condition.

Measurement notes

The probes were collected on 2026-11-01 Asia/Shanghai with page 1, page size 1, and sub_type=all. The counts are matching records, not confirmed vulnerable or exploited deployments. No full asset records or credentials are reproduced.

References

• Configuring ClearML Server
• Securing ClearML Server