CVE-2025-15381

In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using `mlflow server --app-name=basic-auth` are affected.

A contractor or low-privilege service account is granted a MLflow credential with NO_PERMISSIONS to run a limited task. Using standard MLflow REST API calls to the unprotected `/api/2.0/mlflow/traces` and assessment endpoints, they enumerate and download traces from all experiments — including the production LLM fine-tuning experiments they were never authorized to see. The traces contain the full prompt templates, system instructions, and labeled training examples your team spent months curating. In parallel, the attacker creates fraudulent assessments marking a backdoored model variant as high-quality, potentially influencing automated model promotion pipelines that trust MLflow evaluation scores.