CVE-2026-8147: MLflow improper authorization in trace API endpoints

CVE-2026-8147 · Severity: high · CVSS 8.1 · Published 2026-07-02

MLflow is an open-source platform for managing machine learning experiments, models, and deployments. When authentication is enabled, a weakness in the trace API endpoints allows any logged-in user to access, modify, or delete experiment traces regardless of their assigned permissions. This bypasses the authorization system entirely, letting attackers view confidential ML model data, destroy audit trails, or tamper with experiment records they should not be able to touch.

Technologies: mlflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-8147 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8147 being exploited in the wild.
How severe is CVE-2026-8147?
High severity, with a CVSS score of 8.1, published 2 July 2026.
Which products and versions are affected?
mlflow (PyPI) >= 2.14.0rc0, < 3.13.0rc0, ECOSYSTEM:introduced=2.14.0rc0,fixed=3.13.0rc0.
Is there a fix for CVE-2026-8147?
Yes. mlflow (PyPI): upgrade to 3.13.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8147 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-8147?
Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mlflow (PyPI): upgrade to 3.13.0rc0 or later
    pip install "mlflow>=3.13.0rc0"

Technical details

The vulnerability is a missing authorization check in MLflow's trace API endpoints. The root cause is that the `_before_request` handler does not register authorization validators for trace-related endpoints, allowing requests to proceed without permission validation. Affected versions are 2.14.0rc0 through prior to 3.13.0rc0. The attack requires network access to the MLflow API and valid authentication credentials, but no special privileges or user interaction beyond making an HTTP request. An attacker can read sensitive experiment traces, delete them to cover tracks or destroy audit logs, or modify trace data. The vulnerability is fixed in MLflow 3.13.0rc0 and later.

Affected products

  • MLflow MLflow >= 2.14.0rc0, < 3.13.0rc0

Identifiers

  • CVE-2026-8147
  • GHSA-2cm6-r77w-6g96
  • PYSEC-2026-3686

Timeline

  • 2026-07-02: disclosed: Published to GitHub Advisory Database
  • 2026-07-02: patched: Fix released in MLflow 3.13.0rc0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.