---
id: CVE-2025-15381
aliases:
  - GHSA-g6pg-52vf-843h
  - PYSEC-2026-2657
title: MLFlow allows Tracing + Assessments Access
summary: MLFlow allows Tracing + Assessments Access
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
vendor: mlflow
product: mlflow
ecosystem: pip
affected:
  - mlflow <= 3.8.1
published: '2026-03-27'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:39.211467222Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g6pg-52vf-843h'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15381'
  - url: 'https://github.com/mlflow/mlflow'
  - url: >-
      https://github.com/mlflow/mlflow/blob/b569ebc74c14af593c326143bee2df44a5d59edf/mlflow/server/auth/__init__.py#L752
  - url: 'https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c'
tags:
  - osv
  - pip
epss: 0.00331
epssPercentile: 0.23604
ingestedAt: '2026-07-13T18:57:58.102Z'
---

## Overview

In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using `mlflow server --app-name=basic-auth` are affected.

## Affected packages

- `mlflow <= 3.8.1`

## Remediation

Refer to the advisory for the patched release.