Mlflow EUVD-2025-209100

The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network-accessible exploitation with low complexity requiring only low-privilege authenticated access, resulting in high confidentiality and integrity impacts. Real-world risk is moderate-to-high for organizations using MLflow's basic-auth feature in multi-tenant environments where experiment isolation is critical. The PR:L requirement means attackers need valid credentials, reducing the attack surface compared to unauthenticated vulnerabilities. No EPSS score was provided in the intelligence data, and no confirmed active exploitation (CISA KEV) or public proof-of-concept exists at time of analysis. The vulnerability was disclosed through a responsible disclosure platform (HuntrDev), suggesting coordinated disclosure. Priority should be elevated for deployments where unauthorized trace access could expose proprietary model architectures, training data references, or competitive intelligence. Deployments not using the basic-auth application or operating in single-tenant environments face reduced risk.

An authenticated attacker with a low-privilege account on a shared MLflow deployment leverages direct API calls to tracing endpoints, bypassing experiment-level permission checks. The attacker enumerates trace IDs from experiments they do not have access to, retrieves sensitive trace metadata revealing model architecture details, hyperparameters, and training pipeline information belonging to other teams. Additionally, the attacker creates fraudulent assessments on competitor traces to inject misleading evaluation data or disrupt model selection workflows. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and network accessibility (AV:N) make exploitation straightforward for authenticated users with basic API knowledge.