CVE-2025-15381 - Vulnerability Analysis

Overview

mlflow/mlflow with basic-auth app enabled contains a broken access control vulnerability caused by missing permission validators on tracing and assessment endpoints, letting authenticated users with no permissions read trace data and create unauthorized assessments, exploit requires authentication.

Severity & Score

Impact

Authenticated users with no permissions can read trace metadata and create unauthorized assessments, impacting confidentiality and integrity.

Mitigation

Update to the latest version where permission validators protect tracing and assessment endpoints.

References

• https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner