AI agent vulnerability · MLflow

CVE-2025-15381: MLFlow allows Tracing + Assessments Access

highCVSS 3.0 8.1GHSA-g6pg-52vf-843h

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for traces they should not have access to.

Published Mar 27, 2026 · Updated Mar 31, 2026

Affected packages

mlflow

Ecosystem: PyPI
Affected: <= 3.8.1
Fixed in: No patched version yet
Check: pip show mlflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NO_PERMISSIONS on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using mlflow server --app-name=basic-auth are affected.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MLflow vulnerabilities

All MLflow entries