CVE-2026-8147— MLflow 权限许可和访问控制问题漏洞

Authorization Bypass in mlflow/mlflow

In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.

N/A

访问控制不恰当

MLflow 权限许可和访问控制问题漏洞

MLflow是MLflow组织开源的一个简化机器学习开发的平台,包括跟踪实验、将代码打包成可重复的运行以及共享和部署模型。 MLflow 3.14.0之前版本存在权限许可和访问控制问题漏洞，该漏洞源于trace API端点缺乏适当的授权验证器，可能导致任何经过身份验证的用户绕过实验级授权控制，读取、删除和修改其无权限的trace数据，从而暴露敏感数据、破坏审计日志并允许未经授权的修改。

N/A

N/A