GPU VulnDB

Database/AI/ML frameworks & serving

MLflow: trace API endpoints skip authorization, so any user can read or delete others' traces

CVSS 8.1CVE-2026-8147AI/ML frameworks & servingcurated

Impact

With authentication enabled, MLflow's _before_request handler registers no authorization validators for the trace endpoints, so every trace operation proceeds unchecked. Any authenticated user can read, modify and delete traces belonging to experiments they have no permission on. On a shared training or evaluation cluster that is cross-tenant exposure of prompts, inputs and model outputs captured in traces, plus the ability to destroy the trace history other teams rely on as an audit record. The flaw is in the tracking server's authorization layer only; experiment-level permissions still apply on non-trace endpoints. Fixed in MLflow 3.14.0.

Who can reach it

Any authenticated MLflow user who can reach the tracking server's HTTP API. No experiment permissions and no access to the GPU nodes are needed.

What to do

Upgrade MLflow to 3.14.0 or later and restart the tracking server - a single daemon restart, no node drain. If the server is shared across teams, assume traces were readable and deletable by every account that had access, and restrict network reachability of the tracking server until the upgrade lands.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-8147https://github.com/mlflow/mlflow/commit/f9b1eb510478570609ef451984a255775aa4b937https://huntr.com/bounties/b00c3ddd-373e-492f-9bf0-41a28bb21ed5

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.