PT-2026-54935 · Mlflow · Mlflow

Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-8147

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.14.0

Description When authentication is enabled, the trace API endpoints lack proper authorization validators. This occurs because the before request handler fails to register authorization validators for these endpoints, allowing any authenticated user to bypass experiment-level access controls. Consequently, an attacker with a valid account can read, delete, or modify traces on experiments they are not permitted to access. This can lead to the exposure of sensitive data, tampering with experiment telemetry, and the destruction of audit logs.

Recommendations Update to version 3.14.0.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-8147

Affected Products

Mlflow

References · 4

• 🔥 https://huntr.com/bounties/b00c3ddd-373e-492f-9bf0-41a28bb21ed5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8147 · Security Note
• https://github.com/mlflow/mlflow/commit/f9b1eb510478570609ef451984a255775aa4b937 · Note
• https://twitter.com/UpwindMDR/status/2072627596609704427 · Twitter Post