EUVD-2026-41257
GHSA-2cm6-r77w-6g96
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Any authenticated user (PR:L) can remotely (AV:N/AC:L) read and alter other tenants' traces (C:H/I:H); no availability loss beyond deletion of data already covered by integrity, so A:N.
Primary rating from Vendor (huntr_ai).
CVSS VectorVendor: huntr_ai
Lifecycle Timeline
2DescriptionCVE.org
In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the _before_request handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.
AnalysisAI
Broken access control in MLflow prior to 3.14.0 lets any authenticated user read, modify, or delete traces belonging to experiments they are not authorized to access, defeating experiment-level authorization when authentication is enabled. The flaw stems from the trace API endpoints being omitted from the _before_request authorization handler, so requests reach these endpoints without any validator running. No public exploit has been identified at time of analysis, though a fix commit and huntr bounty report are public.
Technical ContextAI
MLflow is an open-source platform for managing the machine learning lifecycle (experiment tracking, model registry, and trace/observability data). Its authenticated server mode enforces per-experiment permissions through a _before_request hook that maps each API route to an authorization validator. This vulnerability (CWE-284, Improper Access Control) is a coverage gap: the trace API routes (used to log, read, update, and delete execution traces attached to experiments) were never registered with a validator, so the permission check that governs other experiment resources is simply never invoked for trace operations. The affected component is the MLflow tracking server itself (cpe:2.3:a:mlflow:mlflow), specifically its Flask-based request-routing/authorization layer.
RemediationAI
Vendor-released patch: upgrade to MLflow 3.14.0 or later, which registers authorization validators for the trace API endpoints (fix commit f9b1eb510478570609ef451984a255775aa4b937). If immediate upgrade is not possible, compensating controls include placing the trace API endpoints behind a reverse proxy or API gateway that enforces per-user/per-experiment access rules (trade-off: requires duplicating MLflow's permission logic externally and is error-prone), or restricting authenticated access to the tracking server to a smaller set of fully trusted users so that horizontal access between them is acceptable (trade-off: reduces the multi-tenant value of authentication). Where traces are not needed, disabling or blocking client tracing to limit exposure of sensitive trace payloads is an option, at the cost of losing observability data. Reference the fix commit and the huntr report (https://huntr.com/bounties/b00c3ddd-373e-492f-9bf0-41a28bb21ed5) for details.
More in Mlflow Mlflow
View allMLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
Authentication bypass in MLflow 3.9.0 and earlier allows unauthenticated remote attackers to access protected Job API an
Remote unauthenticated attackers can read arbitrary files from MLflow server filesystems in versions 3.9.0 and earlier.
Critical command injection in MLflow 3.8.0 enables remote code execution during model deployment when attackers supply m
Path traversal in MLflow's tar.gz extraction (mlflow/mlflow versions <3.7.0) allows remote attackers to overwrite arbitr
Cross-origin request forgery in MLflow 3.9.0's Assistant feature allows remote attackers to bypass loopback-only protect
MLflow, a popular open-source machine learning lifecycle platform, contains a path traversal vulnerability in its pyfunc
Cross-user artifact overwrite in MLflow versions prior to 3.10.0 allows authenticated users with --serve-artifacts mode
Command injection vulnerability in MLflow versions before v3.7.0 that allows attackers to execute arbitrary commands by
Command injection in MLflow's MLServer integration allows unauthenticated adjacent network attackers to execute arbitrar
Local privilege escalation to arbitrary code execution in MLflow versions prior to 3.11.0 stems from insecure temporary
Server-side environment variable disclosure in MLflow versions prior to 3.11.0 allows attackers to exfiltrate sensitive
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today