CVE-2026-8147: MLflow: trace API endpoints lack proper authorization validators

MLflow's auth app (mlflow/server/auth/__init__.py) looks up a validator for each request in BEFORE_REQUEST_HANDLERS. The trace request classes had no entries, so _find_validator() returned None and the _before_request handler let the request through unchecked. Experiment-level permissions therefore did not apply to trace operations.

The attacker needs a valid login on the tracking server, with any permission level, and network access to it. Using the trace endpoints, they can search and read traces from any experiment, delete traces, set or delete trace tags, and link traces to runs. The advisory warns of exposed sensitive data, destroyed audit logs and unauthorized modification. Traces from LLM and agent applications often hold prompts, tool inputs and outputs, and model responses, so a low-privilege user can read other teams' production conversations. Deleting traces also removes evidence of what an agent did.

The pip package mlflow from 2.14.0rc0 up to, but not including, 3.13.0rc0, on servers started with authentication enabled (--app-name basic-auth). The PR describes the missing checks in that mode.

pip show mlflow

Run it on the tracking server, not only on client machines. Also check container images that pin an mlflow version.

Upgrade to mlflow 3.13.0rc0 or later:

pip install --upgrade "mlflow>=3.13.0rc0"

The fix registers validators for the trace endpoints. Each trace is resolved to its parent experiment and checked against that experiment's permissions. Unknown traces, malformed bodies and unknown /mlflow/traces/ sub-paths are denied. The sources list no workaround. Until you upgrade, limit who can log in to the tracking server and keep it off untrusted networks.

Review tracking server access logs for requests to the trace endpoints, such as search, batch get, delete, tag and link-to-run calls, made by users who have no permission on the target experiment. Look for traces that vanished or tags that changed without a known reason. The sources give no log line. Compare each user's experiment permissions with the experiments they queried.

In MLflow versions prior to 3.13.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the _before_request handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications.