8.1 High

CVE-2025-15381 Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow

Description

In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using `mlflow server --app-name=basic-auth` are affected.

CVSS 3.0 detail

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
mlflow/mlflow	Versions not published
Red Hat OpenShift AI (RHOAI)	Versions not published

References

huntr.com huntr.com

Timeline

Published March 27, 2026
Last modified November 3, 2026

The 55 CVEs of mlflow/mlflow →

CVE-2026-8147 In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper… 8.1 High CVE-2026-4035 A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI… 9.1 Critical CVE-2026-3198 MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API… 6.5 Medium CVE-2026-2651 A vulnerability in MLflow… 9.0 Critical

Track this CVE