CVE-2025-15381

MLflow basic-auth users can read traces and add assessments across experiment boundaries

MLflow · MLflow tracking server with basic-auth

First documented disclosure · Review checkpoint

Summary

A user without access to an experiment can retrieve its trace information and add an assessment to a trace.

Severity and exploitation evidence

High · 8.1/10 · CVSS 3.0. Severity source.

Exploitation not established: The researcher documented a successful unauthorized assessment write on a local test server. The reviewed sources do not establish malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The basic-auth request handler lacked the permission checks for trace reads and assessment creation. A valid account could submit a known trace ID directly to those routes.

Conditions required

An MLflow server running the basic-auth app, an authenticated account and a trace ID belonging to an experiment the account cannot access.

Potential impact

The caller can read trace metadata, including request or response previews where present, and create unauthorized evaluation feedback.

Affected versions and configurations

The CNA describes the then-current release without a numbered range. GitHub’s reviewed database lists versions through 3.8.1. The 3.12.0 tag still lacks the affected route mappings.

Fix and mitigation status

3.13.0 is verified to contain the trace and assessment authorization changes from PR 23014. Neither the CNA nor the GitHub advisory specifies a first patched version.

Practical next steps

Upgrade to a supported release containing PR 23014. Test both reading a trace and adding an assessment using an account without a grant on the experiment.

Operating lesson

Check authorization on operations that take a child object’s ID, including evaluation writes. Denying access to the parent experiment alone may leave those routes exposed.

Evidence and limits

Huntr dates the submission to December 27, 2025. March 27, 2026 is the earliest public disclosure verified here. The May 8 merge and June 1 release identify the affected route checks directly, although the release does not name this CVE. MLflow experiment-issue and job authorization advisories cover different endpoints.

Sources