MLflow: Trace API endpoints lack proper authorization validators
MLflow
More for MLflow RSS feed for MLflow
- Severity
- High, CVSS 8.1
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Record
- CVE-2026-8147
- Affects
- MLflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 2, 2026
- Source last modified
- October 25, 2026
Description
In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the _before_request handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.
Description quoted from the NVD record.
Who is affected
MLflow, made by LF Projects, is a platform that teams use to track, manage and share their machine learning work. This flaw affects MLflow versions before 3.14.0 when it runs with user logins (authentication) turned on. In that setup, any user who can log in can get around the permissions set on each experiment in the part of the product that handles traces (saved records of what a model or AI app did). That user could read, delete or change traces in experiments they are not allowed to access. This could expose sensitive data, destroy audit logs and allow unauthorized changes. This flaw is rated High.
What to do
- Find out who runs MLflow for your organization: the person who installed it, or the IT provider or vendor who manages it. That person should handle the steps below.
- If someone in your organization runs MLflow, have them update it to version
3.14.0or later, which fixes this flaw. - If an IT provider or vendor runs MLflow for you, send them this advisory and ask when the update to
3.14.0will be done. - Ask the person who runs MLflow whether it uses user logins (authentication), because this flaw only affects setups where they are turned on.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.