AI Threat Alert
CVE-2025-15381: MLflow: broken access control exposes experiment traces
GHSA-g6pg-52vf-843h HIGH CISA: ATTENDAny authenticated MLflow user — including accounts explicitly granted NO_PERMISSIONS — can read trace data and inject assessments on experiments they own nothing. If your ML platform runs `mlflow server --app-name=basic-auth`, assume all trace contents (prompts, inputs, outputs, metadata) are readable by every internal user until patched. Update MLflow immediately and audit who has any valid credential on your instance.
What is the risk?
Medium-High for organizations running MLflow with basic-auth. Exploitability is trivial — any valid login suffices, no privilege escalation needed. Impact depends on what lives in traces: production LLM call logs frequently contain PII, proprietary prompts, API keys embedded in inputs, and business-sensitive model outputs. The integrity dimension (creating fraudulent assessments) is particularly dangerous for teams using MLflow evaluations to gate model promotion to production — an attacker could silently corrupt model quality signals.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| mlflow | pip | <= 3.8.1 | No patch |
Do you use mlflow? You're affected.
Severity & Risk
Attack Surface
What should I do?
6 steps-
Patch: Update to the fixed MLflow version as soon as available (monitor https://github.com/mlflow/mlflow/releases and the huntr disclosure).
-
Immediate workaround: Place MLflow behind a network perimeter (VPN/firewall) so only authorized users can authenticate at all — reducing the blast radius of the missing endpoint-level authz.
-
Audit access: Review who holds any valid MLflow credential; revoke dormant accounts.
-
Rotate secrets: If trace logs may contain API keys or credentials passed as model inputs, rotate them.
-
Detection: Review MLflow access logs for cross-experiment trace reads by users who own no runs in those experiments.
-
Consider disabling assessments feature if not in active use until patched.
CISA SSVC Assessment
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
Classification
Compliance Impact
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-15381?
Any authenticated MLflow user — including accounts explicitly granted NO_PERMISSIONS — can read trace data and inject assessments on experiments they own nothing. If your ML platform runs `mlflow server --app-name=basic-auth`, assume all trace contents (prompts, inputs, outputs, metadata) are readable by every internal user until patched. Update MLflow immediately and audit who has any valid credential on your instance.
Is CVE-2025-15381 actively exploited?
No confirmed active exploitation of CVE-2025-15381 has been reported, but organizations should still patch proactively.
How to fix CVE-2025-15381?
1. Patch: Update to the fixed MLflow version as soon as available (monitor https://github.com/mlflow/mlflow/releases and the huntr disclosure). 2. Immediate workaround: Place MLflow behind a network perimeter (VPN/firewall) so only authorized users can authenticate at all — reducing the blast radius of the missing endpoint-level authz. 3. Audit access: Review who holds any valid MLflow credential; revoke dormant accounts. 4. Rotate secrets: If trace logs may contain API keys or credentials passed as model inputs, rotate them. 5. Detection: Review MLflow access logs for cross-experiment trace reads by users who own no runs in those experiments. 6. Consider disabling assessments feature if not in active use until patched.
What systems are affected by CVE-2025-15381?
This vulnerability affects the following AI/ML architecture patterns: MLOps experiment tracking platforms, LLM fine-tuning pipelines, Model evaluation and promotion pipelines, Multi-tenant ML development environments, RAG development and evaluation workflows.
What is the CVSS score for CVE-2025-15381?
CVE-2025-15381 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.01%.
Technical Details
NVD Description
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using `mlflow server --app-name=basic-auth` are affected.
Exploitation Scenario
A contractor or low-privilege service account is granted a MLflow credential with NO_PERMISSIONS to run a limited task. Using standard MLflow REST API calls to the unprotected `/api/2.0/mlflow/traces` and assessment endpoints, they enumerate and download traces from all experiments — including the production LLM fine-tuning experiments they were never authorized to see. The traces contain the full prompt templates, system instructions, and labeled training examples your team spent months curating. In parallel, the attacker creates fraudulent assessments marking a backdoored model variant as high-quality, potentially influencing automated model promotion pipelines that trust MLflow evaluation scores.
Weaknesses (CWE)
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N References
Timeline
Related Vulnerabilities
CVE-2025-15379 10.0 MLflow: RCE via unsanitized model dependency specs
Same package: mlflow CVE-2023-3765 10.0 MLflow: path traversal allows arbitrary file read
Same package: mlflow CVE-2023-2780 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow CVE-2026-2635 9.8 mlflow: security flaw enables exploitation
Same package: mlflow CVE-2023-1177 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow