CVE-2025-15381

In the latest version of mlflow/mlflow, when the "basic-auth" app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with "NOPERMISSIONS" on the experiment, to read trace information and create assessments f...

CVE-2025-15381: Exposure of Sensitive Information to an Unauthorized Actor

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...