Executive brief
MLflow is an open-source platform for managing machine learning experiments, models, and deployments. When authentication is enabled, a weakness in the trace API endpoints allows any logged-in user to access, modify, or delete experiment traces regardless of their assigned permissions. This bypasses the authorization system entirely, letting attackers view confidential ML model data, destroy audit trails, or tamper with experiment records they should not be able to touch.
Technical details
The vulnerability is a missing authorization check in MLflow's trace API endpoints. The root cause is that the `_before_request` handler does not register authorization validators for trace-related endpoints, allowing requests to proceed without permission validation. Affected versions are 2.14.0rc0 through prior to 3.13.0rc0. The attack requires network access to the MLflow API and valid authentication credentials, but no special privileges or user interaction beyond making an HTTP request. An attacker can read sensitive experiment traces, delete them to cover tracks or destroy audit logs, or modify trace data. The vulnerability is fixed in MLflow 3.13.0rc0 and later.
Affected products
- MLflow MLflow >= 2.14.0rc0, < 3.13.0rc0
Timeline
- 2026-07-02: disclosed: Published to GitHub Advisory Database
- 2026-07-02: patched: Fix released in MLflow 3.13.0rc0