Authorization Bypass in MLflow Affects Data Integrity and Security

CVE-2026-8147

What is CVE-2026-8147?

In MLflow versions prior to 3.14.0, a significant authorization bypass vulnerability allows authenticated users to access and manipulate experiment traces without appropriate permissions. The trace API endpoints are vulnerable due to the absence of proper authorization validators within the _before_request handler. This oversight permits unauthorized access to sensitive operations, including reading, modifying, and deleting traces of experiments that users should not be able to interact with. Consequently, this vulnerability poses a risk to data integrity, may compromise sensitive information, and can lead to the destruction of audit logs.

References