CVE-2026-8147

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.14.0

Description When authentication is enabled, the trace API endpoints lack proper authorization validators. This occurs because the before request handler fails to register authorization validators for these endpoints, allowing any authenticated user to bypass experiment-level access controls. Consequently, an attacker with a valid account can read, delete, or modify traces on experiments they are not permitted to access. This can lead to the exposure of sensitive data, tampering with experiment telemetry, and the destruction of audit logs.

Recommendations Update to version 3.14.0.