Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using `mlflow server --app-name=basic-auth` are affected.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2025-15381 In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows… https://www.cve.org/CVERecord?id=CVE-2025-15381
Post summary
The text announces CVE-2025-15381, highlighting that in mlflow’s latest release, enabling basic‑auth leaves certain endpoints unprotected, exposing them to unauthorized access.
🟠 CVE-2025-15381 - High In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, ... https://www.thehackerwire.com/vulnerability/CVE-2025-15381/ https://t.co/ScyDoarspG
Post summary
The tweet discloses a high‑severity vulnerability in mlflow’s latest version, noting that enabling the basic‑auth app leaves tracing and assessment endpoints unprotected, potentially enabling authenticated users to bypass proper authorization.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | lfprojects | mlflow | - | - | - |