CVE-2026-8147: 
NixOS vulnerability analysis and mitigation

CVE-2026-8147 is an authorization bypass vulnerability in MLflow's trace API endpoints that allows any authenticated user to bypass experiment-level access controls. Affecting all MLflow versions prior to 3.14.0, the flaw enables unauthorized reading, deletion, and modification of traces across experiments the user has no permission to access. It was disclosed on July 2, 2026, via the huntr.dev bug bounty platform and carries a CVSS v3.0 base score of 8.1 (High) (Github Advisory, Huntr Bounty).

The root cause is classified as CWE-284 (Improper Access Control) and CWE-425 (Direct Request / Forced Browsing): the _before_request handler in MLflow's authentication module (mlflow/server/auth/__init__.py) did not register authorization validators for any trace API endpoints, meaning requests to those endpoints proceeded without any permission check (Github Advisory). An attacker with any valid MLflow account can directly call trace endpoints — such as GetTraceInfo, SearchTraces, DeleteTraces, SetTraceTag, StartTrace, EndTrace, and related operations — using standard HTTP requests, bypassing the experiment-level RBAC that protects other MLflow resources. The fix (commit f9b1eb5) adds explicit validator mappings for all trace-related routes in BEFORE_REQUEST_VALIDATORS and introduces regex-based matching for parameterized trace paths (e.g., /mlflow/traces/<trace_id>/tags), with a fail-closed default for unrecognized paths under the /mlflow/traces/ prefix (MLflow Commit).

Any authenticated MLflow user can read sensitive ML experiment trace data — including model inputs, outputs, and intermediate steps — from experiments they are not authorized to access, resulting in high confidentiality impact. They can also delete traces (destroying audit logs and experiment history) and modify trace tags and metadata, resulting in high integrity impact. Availability is not directly impacted, but the destruction of audit logs can impede incident response and compliance efforts (Github Advisory, Huntr Bounty).

A proof-of-concept exploit is publicly available on the huntr.com bug bounty platform, submitted as part of the awarded bounty (Huntr Bounty). CISA's SSVC assessment classifies exploitation as "poc" with "total" technical impact, though the vulnerability is not listed as automatable (NVD). There is no confirmed evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.34%, indicating a relatively low near-term exploitation probability (Github Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Obtain valid credentials: Acquire any valid MLflow account on the target instance — even a low-privileged user account with access to only one experiment is sufficient.
2. Identify target experiments: Use the MLflow UI or API (SearchExperiments) to enumerate experiment IDs that the attacker's account cannot normally access.
3. Call trace endpoints without authorization check: Send direct HTTP requests to trace API endpoints (e.g., GET /ajax-api/2.0/mlflow/traces?experiment_ids=<target_experiment_id> or GET /ajax-api/2.0/mlflow/traces/<trace_id>) using the attacker's valid session token or API key. Because the _before_request handler does not register validators for these routes, the server processes the request without checking experiment-level permissions.
4. Read sensitive trace data: Parse the response to extract ML model inputs, outputs, parameters, and intermediate computation steps from the target experiment's traces.
5. Modify or delete traces: Issue DELETE /ajax-api/2.0/mlflow/traces?experiment_id=<target_experiment_id> or POST requests to tag/update endpoints to tamper with or destroy trace records, eliminating audit evidence (Huntr Bounty, MLflow Commit).

• Network: HTTP requests to MLflow trace API endpoints (e.g., /ajax-api/2.0/mlflow/traces, /ajax-api/2.0/mlflow/traces/<trace_id>, /ajax-api/2.0/mlflow/traces/<trace_id>/tags) originating from users who do not own or have explicit access to the queried experiment IDs.
• Logs: MLflow access logs showing authenticated users querying trace endpoints for experiment IDs outside their assigned permissions; repeated GET or DELETE requests to /mlflow/traces paths from a single user across multiple experiment IDs in a short time window.
• Logs: Absence of authorization error responses (HTTP 403) for trace endpoint requests that would be expected to fail under proper access controls — indicating the pre-patch behavior.
• Application Behavior: Unexpected deletion of trace records or modification of trace tags in experiments, particularly if the acting user is not an experiment owner or collaborator (Huntr Bounty).

Upgrade MLflow to version 3.14.0 or later, which registers proper authorization validators for all trace API endpoints (MLflow Commit, Github Advisory). As a temporary workaround until patching is possible, restrict MLflow authentication credentials to only fully trusted users and apply network-level controls (e.g., firewall rules or reverse proxy ACLs) to limit access to the MLflow server. Monitor trace API access logs for requests to experiment IDs that the requesting user does not own.

Red Hat opened a high-severity bug tracker entry (Bugzilla #2496410) for this CVE, indicating it is being tracked for potential impact on Red Hat products that may include MLflow (Red Hat Bugzilla). The vulnerability was discovered and reported through the huntr.dev AI/ML security bug bounty program, which requires a working PoC for every awarded bounty, underscoring the practical exploitability of the issue (Huntr Bounty). No significant broader media coverage or notable researcher commentary beyond the advisory and bounty disclosure has been identified at this time.