CVE-2025-15381 mlflow CVE debrief

Who should care

Users of mlflow/mlflow who have enabled the `basic-auth` app should be aware of this vulnerability. This includes anyone using mlflow/mlflow for tracing and assessment, especially in environments where multiple users have access to the system. Security teams should prioritize patching or mitigating this vulnerability to prevent unauthorized access to sensitive information.

Technical summary

The vulnerability exists in the mlflow/mlflow project when the `basic-auth` app is enabled. Tracing and assessment endpoints do not have proper permission validation, allowing authenticated users to access and create assessments for traces they should not have access to. This is due to a lack of permission checks on these endpoints. The vulnerability has a CVSS score of 7.1 and is considered high severity.

Defensive priority

High priority should be given to patching or mitigating this vulnerability. As the vulnerability allows unauthorized access to sensitive information and creation of assessments, defenders should act quickly to protect their environments.

Recommended defensive actions

• Update to a patched version of mlflow/mlflow as soon as available.
• Disable the `basic-auth` app if not required.
• Implement additional access controls or permission checks for tracing and assessment endpoints.
• Monitor for suspicious activity on tracing and assessment endpoints.
• Review and update user permissions to ensure least privilege access.

Evidence notes

The vulnerability was reported by [email protected] and is documented in the NVD and CVE records. Multiple sources, including Red Hat, have provided additional information and references. However, the exact scope of affected systems and users is not fully clear from the available information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.