Is CVE-2025-15381 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15381 being exploited in the wild.

How severe is CVE-2025-15381?

High severity, with a CVSS score of 7.1, published 27 March 2026.

Which products and versions are affected?

mlflow (PyPI) ECOSYSTEM:introduced=0,last_affected=3.8.1.

Is there a fix for CVE-2025-15381?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-15381 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-15381?

Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15381: MLflow authorization bypass in tracing and assessment endpoints

CVE-2025-15381 · Severity: high · CVSS 7.1 · Published 2026-03-27

MLflow is an open-source platform used by organizations to manage the machine learning lifecycle, including tracking experiments and models. A security flaw in its authentication system allows any logged-in user to view sensitive experiment trace data and create unauthorized assessments, even if they lack permission for that specific project. This could lead to the exposure of proprietary research data or the corruption of experiment evaluations.

Technologies: mlflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-15381 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15381 being exploited in the wild.
How severe is CVE-2025-15381?: High severity, with a CVSS score of 7.1, published 27 March 2026.
Which products and versions are affected?: mlflow (PyPI) ECOSYSTEM:introduced=0,last_affected=3.8.1.
Is there a fix for CVE-2025-15381?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-15381 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-15381?: Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass (CWE-425) exists in MLflow when the `basic-auth` application is enabled via `mlflow server --app-name=basic-auth`. The tracing and assessment endpoints fail to implement proper permission validators. As a result, any authenticated user—including those explicitly assigned `NO_PERMISSIONS` for a specific experiment—can perform direct requests to read trace metadata and create new assessments. This allows for unauthorized information disclosure and data modification. Red Hat notes that while their OpenShift AI product contains the affected code, it is not exploitable in default configurations as `basic-auth` is not used.

Affected products

MLflow MLflow latest
Red Hat OpenShift AI (RHOAI)

Identifiers

CVE-2025-15381
GHSA-g6pg-52vf-843h
PYSEC-2026-2657

Timeline

2025-01-01: other: Initial release date listed in CSAF metadata
2026-03-27: disclosed: Vulnerability reported and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.