MLflowGHSA-g6pg-52vf-843h
MLFlow allows Tracing + Assessments Access
High8.1CVE-2025-15381 · Published Mar 27, 2026 · updated Sep 10, 2026
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using `mlflow server --app-name=basic-auth` are affected.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | <= 3.8.1 | No fix yet |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- CVE-2025-15381, PYSEC-2026-2657
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 3 | MLflow: remote code execution Critical9.1Apr 3 | Critical9.1 | No fix yet |
| Mar 31 | Mlflow: Command Injection when serving models with enable_mlserver=TrueCritical9.6Mar 31 | Critical9.6 | 3.9.0 |
| Mar 30 | MLflow Command Injection vulnerabilityCritical10.0Mar 30 | Critical10.0 | 3.8.1 |
| Mar 30 | MLFlow path traversal vulnerabilityCritical9.6Mar 30 | Critical9.6 | 3.9.0rc0 |
| Mar 19 | Arbitrary file write via tar traversal in mlflowHigh8.1Mar 19 | High8.1 | 3.9.0rc0 |
| Mar 16 | MLflow has a command injection in mlflow/sagemaker/__init__.pyHigh7.5Mar 16 | High7.5 | 3.8.0rc0 |