EUVD-2026-41257
GHSA-2cm6-r77w-6g96
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege MLflow account
-
DeliveryEnumerate other users' experiment IDs
-
ExploitSend trace API request for foreign experiment
-
ExecutionRead, modify, or delete traces
-
ImpactExfiltrate sensitive data or destroy audit logs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) MLflow running with authentication enabled - the built-in permission model must be active, otherwise there is nothing to bypass; and (2) the attacker holding a valid authenticated account of any privilege level (PR:L). The attack targets trace API endpoints specifically and works only against MLflow versions prior to 3.14.0. Limiting factors: exploitation is meaningful only in multi-user/multi-tenant setups where experiments have distinct owners; a single-user or fully-trusted-user deployment gains no attacker advantage. No user interaction is required and the vector is network-reachable. |
| Impact | The supplied CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) describes a network-reachable, low-complexity attack requiring only low privileges (any valid authenticated account) with high confidentiality and integrity impact and no availability impact - consistent with a horizontal privilege-escalation / authorization-bypass against multi-tenant trace data. No EPSS score, KEV listing, POC flag, or SSVC decision was provided in the input, so real-world exploitation probability cannot be quantified from the data; the risk rests on the CVSS signal plus the existence of a public fix commit and bounty report. The realistic priority is moderate-to-high specifically for organizations running MLflow's authentication mode as a shared multi-user/multi-tenant deployment, where trace segregation matters; single-tenant or unauthenticated internal deployments derive little marginal risk since any authenticated user already broadly trusted. Note the vector is CVSS 3.0 (not 3.1) as provided - a minor point but preserved as given. |
| Exploit ScenarioDerived | An attacker with any valid low-privilege MLflow account on an authenticated, multi-tenant tracking server sends trace API requests referencing experiment IDs owned by other teams. Because no authorization validator runs for trace endpoints, the server returns or modifies those traces, letting the attacker exfiltrate sensitive prompt/inference data, tamper with results, or delete traces to destroy audit history. No public POC is referenced, but the fix commit reveals the exact missing validator registration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
Broken access control in MLflow prior to 3.14.0 lets any authenticated user read, modify, or delete traces belonging to experiments they are not authorized to access, defeating experiment-level authorization when authentication is enabled. The flaw stems from the trace API endpoints being omitted from the _before_request authorization handler, so requests reach these endpoints without any validator running. No public exploit has been identified at time of analysis, though a fix commit and huntr bounty report are public.
RemediationAI
Vendor-released patch: upgrade to MLflow 3.14.0 or later, which registers authorization validators for the trace API endpoints (fix commit f9b1eb510478570609ef451984a255775aa4b937). If immediate upgrade is not possible, compensating controls include placing the trace API endpoints behind a reverse proxy or API gateway that enforces per-user/per-experiment access rules (trade-off: requires duplicating MLflow's permission logic externally and is error-prone), or restricting authenticated access to the tracking server to a smaller set of fully trusted users so that horizontal access between them is acceptable (trade-off: reduces the multi-tenant value of authentication). Where traces are not needed, disabling or blocking client tracing to limit exposure of sensitive trace payloads is an option, at the cost of losing observability data. Reference the fix commit and the huntr report (https://huntr.com/bounties/b00c3ddd-373e-492f-9bf0-41a28bb21ed5) for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MLflow is an open-source platform for managing the machine learning lifecycle (experiment tracking, model registry, and trace/observability data). Its authenticated server mode enforces per-experiment permissions through a _before_request hook that maps each API route to an authorization validator. This vulnerability (CWE-284, Improper Access Control) is a coverage gap: the trace API routes (used to log, read, update, and delete execution traces attached to experiments) were never registered with a validator, so the permission check that governs other experiment resources is simply never invoked for trace operations. The affected component is the MLflow tracking server itself (cpe:2.3:a:mlflow:mlflow), specifically its Flask-based request-routing/authorization layer.
Know when Mlflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Any authenticated user (PR:L) can remotely (AV:N/AC:L) read and alter other tenants' traces (C:H/I:H); no availability loss beyond deletion of data already covered by integrity, so A:N.
Primary rating from Vendor (huntr_ai).
CVSS VectorVendor: huntr_ai
Lifecycle Timeline
1DescriptionCVE.org
In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the _before_request handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.
Executive ViewAI
A broken access control vulnerability in MLflow allows authenticated users to access, modify, and delete machine learning experiment traces and data beyond their authorization scope. This creates risk of intellectual property theft, data integrity compromise, and regulatory non-compliance for organizations managing ML experiments and sensitive model training data. Immediate risk mitigation and patching required to protect research and model assets.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network-level access restrictions to limit MLflow connectivity to authorized networks only; enable and actively monitor detailed trace API audit logs for unauthorized access attempts; enforce principle of least privilege on all MLflow authentication credentials with regular rotation; implement API rate limiting and request throttling on trace endpoints; restrict trace API access to minimum necessary users if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking serv
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Exploit-DB