CVE-2026-8147: MLflow Auth Bypass Vulnerability

CVE-2026-8147 Overview

CVE-2026-8147 is a broken access control vulnerability [CWE-284] in MLflow versions prior to 3.14.0. When MLflow runs with authentication enabled, the trace API endpoints fail to register authorization validators. Any authenticated user can bypass experiment-level authorization checks and read, delete, or modify traces belonging to experiments they do not own. The flaw resides in the _before_request handler, which omits validator registration for trace routes. Requests to these endpoints proceed without permission checks, exposing sensitive machine learning telemetry, audit logs, and experiment data across tenant boundaries.

Critical Impact
Any authenticated MLflow user can read, delete, or modify traces belonging to experiments they do not have permission to access, enabling data exposure, audit log destruction, and unauthorized modification of ML experiment records.

Affected Products

MLflow versions prior to 3.14.0 with authentication enabled
MLflow trace API endpoints (read, delete, modify operations)
Multi-tenant MLflow deployments relying on experiment-level authorization

Discovery Timeline

2026-07-02 - CVE-2026-8147 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-8147

Vulnerability Analysis

MLflow implements experiment-level authorization through a Flask _before_request handler that dispatches incoming requests to authorization validators mapped by endpoint. Each protected route is expected to have a corresponding validator that verifies the calling user holds the appropriate permission on the target experiment.

The trace API endpoints were introduced without corresponding validator entries in this dispatch mapping. When the _before_request handler processes a trace request, it finds no validator registered and returns early, allowing the request to reach the handler with no permission enforcement. This affects trace read, delete, and update operations across the API surface.

The consequences extend beyond confidentiality. Traces frequently contain prompts, model inputs, outputs, and intermediate reasoning artifacts. Deletion of traces destroys evidence used for compliance auditing and model governance. Modification enables tampering with recorded experiment history.

Root Cause

The root cause is missing authorization coverage [CWE-284] in the _before_request handler. Developers added trace endpoints to the API surface without updating the validator registry that gates access. Authentication succeeds because global auth middleware runs first, but authorization is silently skipped for unmapped routes rather than defaulting to deny.

Attack Vector

Exploitation requires only valid credentials on the MLflow tracking server. An authenticated attacker sends HTTP requests directly to trace endpoints referencing experiments owned by other users. Because no validator runs, the server returns or modifies the requested trace data. The attack requires no elevated privileges, no user interaction, and executes over the network against the tracking server.

The vulnerability mechanism is described in the upstream fix. See the GitHub commit f9b1eb5 and the Huntr bounty report for the authoritative technical description and patch details.

Detection Methods for CVE-2026-8147

Indicators of Compromise

Requests to trace API endpoints (paths containing /traces or /mlflow/traces) originating from user accounts that do not own the referenced experiment.
Unexpected DELETE operations against trace resources, or bulk trace reads from a single authenticated principal.
Gaps in trace history for experiments where deletions were not initiated by the experiment owner.

Detection Strategies

Enable MLflow request logging and compare the authenticated user identity against the experiment owner for every trace API call.
Alert on trace API requests that succeed for principals lacking membership in the target experiment's permission list.
Correlate MLflow application logs with reverse proxy access logs to detect trace endpoint activity not accompanied by prior experiment permission grants.

Monitoring Recommendations

Ingest MLflow tracking server logs into a centralized log platform and build queries that join user identity with experiment ownership metadata.
Monitor the MLflow database for unexpected changes to the trace tables, including deletions and updates outside normal training workflows.
Track upgrade status across all MLflow tracking servers to confirm every instance runs 3.14.0 or later.

How to Mitigate CVE-2026-8147

Immediate Actions Required

Upgrade all MLflow tracking servers to version 3.14.0 or later, where trace endpoints register authorization validators in the _before_request handler.
Audit trace access logs for the retention window to identify any cross-tenant reads, deletions, or modifications that occurred before patching.
Rotate any secrets, prompts, or API keys that may have been captured in traces accessible to unauthorized users.

Patch Information

The fix is committed upstream in MLflow commit f9b1eb5, which registers authorization validators for trace API endpoints. The patched release is MLflow 3.14.0. Additional context is available in the Huntr disclosure.

Workarounds

Restrict network access to the MLflow tracking server so only trusted users can authenticate, reducing the pool of principals able to exploit the missing validator.
Place the tracking server behind a reverse proxy that enforces path-level access controls on trace API routes until the upgrade completes.
Disable trace ingestion and querying features if they are not required in the deployment, eliminating exposure of the affected endpoints.

bash

# Upgrade MLflow to a patched version
pip install --upgrade 'mlflow>=3.14.0'

# Verify installed version
mlflow --version