Executive brief
MLflow is an open-source platform used by organizations to manage the machine learning lifecycle, including tracking experiments and models. A security flaw in its authentication system allows any logged-in user to view sensitive experiment trace data and create unauthorized assessments, even if they lack permission for that specific project. This could lead to the exposure of proprietary research data or the corruption of experiment evaluations.
Technical details
An authorization bypass (CWE-425) exists in MLflow when the `basic-auth` application is enabled via `mlflow server --app-name=basic-auth`. The tracing and assessment endpoints fail to implement proper permission validators. As a result, any authenticated user—including those explicitly assigned `NO_PERMISSIONS` for a specific experiment—can perform direct requests to read trace metadata and create new assessments. This allows for unauthorized information disclosure and data modification. Red Hat notes that while their OpenShift AI product contains the affected code, it is not exploitable in default configurations as `basic-auth` is not used.
Affected products
- MLflow MLflow latest
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2025-01-01: other: Initial release date listed in CSAF metadata
- 2026-03-27: disclosed: Vulnerability reported and published