{"id":"CVE-2026-8147","aliases":["BIT-mlflow-2026-8147","CLSA-2026-1788442606","EUVD-2026-41257","GHSA-2cm6-r77w-6g96","PYSEC-2026-3686"],"status":"published","title":"Authorization Bypass in mlflow/mlflow","description":"In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00548,"percentile":0.46153,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2026-07-02T07:32:58Z","modified":"2026-10-30T02:15:08Z","fixes":[{"ecosystem":"PyPI","package":"mlflow","fixed_in":["3.13.0rc0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"mlflow","fixed_in":["3.14.0"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"mlflow","fixed_in":["2.22.4.post8+tuxcare"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.0rc0"},{"fixed":"3.13.0rc0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mlflow","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.14.0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.4"},{"fixed":"2.22.4.post8+tuxcare"}]}],"versions":["2.22.4","2.22.4.post1+tuxcare","2.22.4.post2+tuxcare","2.22.4.post3+tuxcare","2.22.4.post4+tuxcare","2.22.4.post5+tuxcare","2.22.4.post6+tuxcare","2.22.4.post7+tuxcare"]},{"source":"osv","ecosystem":"PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.0rc0"},{"fixed":"3.13.0rc0"}]}],"versions":["2.14.0","2.14.0rc0","2.14.1","2.14.2","2.14.2.dev0","2.14.3","2.15.0","2.15.0rc0","2.15.1","2.16.0","2.16.1","2.16.2","2.17.0","2.17.0rc0","2.17.1","2.17.2","2.18.0","2.18.0rc0","2.19.0","2.19.0rc0","2.20.0","2.20.0rc0","2.20.1","2.20.2","2.20.3","2.20.4","2.21.0","2.21.0rc0","2.21.1","2.21.2","2.21.3","2.22.0","2.22.0rc0","2.22.1","2.22.2","2.22.3","2.22.4","2.22.5","3.0.0","3.0.0rc0","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.1","3.1.0","3.1.0rc0","3.1.1","3.1.2","3.1.3","3.1.4","3.10.0","3.10.0rc0","3.10.1","3.11.0","3.11.0rc0","3.11.0rc1","3.11.1","3.12.0","3.12.0rc0","3.2.0","3.2.0rc0","3.3.0","3.3.0rc0","3.3.1","3.3.2","3.4.0","3.4.0rc0","3.5.0","3.5.0rc0","3.5.1","3.6.0","3.6.0rc0","3.7.0","3.7.0rc0","3.8.0","3.8.0rc0","3.8.1","3.9.0","3.9.0rc0"]},{"source":"osv","ecosystem":"PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.0rc0"},{"fixed":"3.13.0rc0"}]}],"versions":["2.14.0","2.14.0rc0","2.14.1","2.14.2","2.14.2.dev0","2.14.3","2.15.0","2.15.0rc0","2.15.1","2.16.0","2.16.1","2.16.2","2.17.0","2.17.0rc0","2.17.1","2.17.2","2.18.0","2.18.0rc0","2.19.0","2.19.0rc0","2.20.0","2.20.0rc0","2.20.1","2.20.2","2.20.3","2.20.4","2.21.0","2.21.0rc0","2.21.1","2.21.2","2.21.3","2.22.0","2.22.0rc0","2.22.1","2.22.2","2.22.3","2.22.4","2.22.5","3.0.0","3.0.0rc0","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.1","3.1.0","3.1.0rc0","3.1.1","3.1.2","3.1.3","3.1.4","3.10.0","3.10.0rc0","3.10.1","3.11.0","3.11.0rc0","3.11.0rc1","3.11.1","3.12.0","3.12.0rc0","3.2.0","3.2.0rc0","3.3.0","3.3.0rc0","3.3.1","3.3.2","3.4.0","3.4.0rc0","3.5.0","3.5.0rc0","3.5.1","3.6.0","3.6.0rc0","3.7.0","3.7.0rc0","3.8.0","3.8.0rc0","3.8.1","3.9.0","3.9.0rc0"]}],"products":[{"vendor":"lfprojects","product":"mlflow"},{"vendor":"mlflow","product":"mlflow/mlflow"}],"references":[{"url":"https://huntr.com/bounties/b00c3ddd-373e-492f-9bf0-41a28bb21ed5","tags":["exploit","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/mlflow/mlflow/commit/f9b1eb510478570609ef451984a255775aa4b937","tags":["Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8147","tags":["web","advisory"]},{"url":"https://github.com/mlflow/mlflow/pull/23014","tags":["web"]},{"url":"https://github.com/mlflow/mlflow/releases/tag/v3.13.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2cm6-r77w-6g96","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8147.json","tags":["advisory"]},{"url":"https://github.com/mlflow/mlflow","tags":["package"]},{"url":"https://pypi.org/project/mlflow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-8147","title":"Authorization Bypass in mlflow/mlflow","description":"In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.","status":"published","published":"2026-07-02T07:32:58.308Z","modified":"2026-07-02T12:28:31.554Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-41257","description":"In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.","status":"published","published":"2026-07-02T07:32:58Z","modified":"2026-07-02T12:28:31Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:17.786883Z"}],"ghsa":[{"id":"GHSA-2cm6-r77w-6g96","title":"MLflow: trace API endpoints lack proper authorization validators","description":"In MLflow versions prior to 3.13.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.","status":"published","published":"2026-07-02T09:32:03Z","modified":"2026-08-13T18:27:49Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-8147","description":"In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.","status":"published","published":"2026-07-02T09:16:19.1Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:27.199837Z"}],"osv":[{"id":"CVE-2026-8147","title":"Authorization Bypass in mlflow/mlflow","description":"In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.","status":"published","published":"2026-07-02T07:32:58.308Z","modified":"2026-10-28T02:30:25.879415384Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"GHSA-2cm6-r77w-6g96","title":"MLflow: trace API endpoints lack proper authorization validators","description":"In MLflow versions prior to 3.13.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.","status":"published","published":"2026-07-02T09:32:03Z","modified":"2026-08-19T12:55:38.896729948Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"PYSEC-2026-3686","title":"MLflow: trace API endpoints lack proper authorization validators","description":"In MLflow versions prior to 3.13.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.","status":"published","published":"2026-08-19T11:56:24.904399Z","modified":"2026-08-19T12:55:38.896729948Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"BIT-mlflow-2026-8147","title":"Authorization Bypass in mlflow/mlflow","description":"In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.","status":"published","published":"2026-07-06T23:44:39.868Z","modified":"2026-09-08T08:48:13.520369146Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"CLSA-2026-1788442606","title":"TuxCare security update for mlflow (1 CVE)","description":"TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.22.4.post8+tuxcare.","status":"published","published":"2026-09-03T13:36:46Z","modified":"2026-10-30T02:15:08.145239477Z","updated_at":"2026-11-02T15:43:47.591214Z"}]}}