CVE-2025-15381
Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NO_PERMISSIONS on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using mlflow server --app-name=basic-auth are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List
Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NO_PERMISSIONS on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using mlflow server --app-name=basic-auth are affected.
- Record
CVE-2025-15381- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-200, CWE-425
- Updated
- 2026-11-03
EUVDEUVD-2025-209100
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NO_PERMISSIONS on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using mlflow server --app-name=basic-auth are affected.
- Record
EUVD-2025-209100- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g6pg-52vf-843h
MLFlow allows Tracing + Assessments Access
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NO_PERMISSIONS on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using mlflow server --app-name=basic-auth are affected.
- Record
GHSA-g6pg-52vf-843h- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NO_PERMISSIONS on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using mlflow server --app-name=basic-auth are affected.
- Record
CVE-2025-15381- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-200, CWE-425
- Updated
- 2026-11-04
OSVGHSA-g6pg-52vf-843h
MLFlow allows Tracing + Assessments Access
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NO_PERMISSIONS on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using mlflow server --app-name=basic-auth are affected.
- Record
GHSA-g6pg-52vf-843h- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVPYSEC-2026-2657
MLFlow allows Tracing + Assessments Access
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NO_PERMISSIONS on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using mlflow server --app-name=basic-auth are affected.
- Record
PYSEC-2026-2657- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1790340259 No score
TuxCare security update for mlflow (1 CVE)
TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.22.4.post10+tuxcare.
- Record
CLSA-2026-1790340259- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mlflowPyPI |
through 3.8.1 | None known |
mlflowTuxCare:PyPI |
2.22.4 up to 2.22.4.post10+tuxcare, plus listed versions 2.22.4.post1+tuxcare2.22.4.post2+tuxcare2.22.4.post3+tuxcare2.22.4.post4+tuxcare2.22.4.post5+tuxcare Show 4 moreShow less2.22.4.post6+tuxcare2.22.4.post7+tuxcare2.22.4.post8+tuxcare2.22.4.post9+tuxcare |
2.22.4.post10+tuxcare |
mlflowPyPI |
through 3.8.1, plus listed versions 0.0.10.1.00.2.00.2.10.3.0 Show 45 moreShow less0.4.00.4.10.4.20.5.00.5.10.5.20.6.00.7.00.8.00.8.10.8.20.9.00.9.0.10.9.11.0.01.1.01.1.1.dev01.10.01.11.01.12.01.12.11.131.13.11.14.01.14.11.15.01.16.01.17.01.18.01.19.01.2.01.20.01.20.11.20.21.21.01.22.01.23.01.23.11.24.01.25.01.25.11.26.01.26.11.27.01.28.0 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List, EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-15381 is a high vulnerability (CVSS 8.1) in Lfprojects Mlflow, published March 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in mlflow 2.22.4.post10+tuxcare.
References
huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c
access.redhat.com/security/cve/CVE-2025-15381
bugzilla.redhat.com/show_bug.cgi?id=2452341
security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15381.json
nvd.nist.gov/vuln/detail/CVE-2025-15381
github.com/mlflow/mlflow/blob/b569ebc74c14af593c326143bee2df44a5d59edf/mlflow/server/auth/__init__.py
pypi.org/project/mlflow
Left out here: 117 versions. The JSON record has them.