MLflow Trace API Authorization Bypass in Authentication Mode

CVE-2026-8147 is an authorization control vulnerability in MLflow versions before 3.14.0 that allows authenticated users to bypass experiment-level access restrictions on trace operations. When authentication is enabled, the trace API endpoints fail to implement proper authorization validators, enabling any authenticated user to read, delete, and modify traces across experiments they should not have permission to access. This is particularly critical for organizations using MLflow in multi-tenant environments or shared research platforms where experiment isolation is essential for data governance, intellectual property protection, and compliance. Any deployment running MLflow with authentication but relying on experiment-level access controls is affected, making this a high-impact vulnerability (CVSS 8.1) affecting the confidentiality and integrity of machine learning artifacts and metadata.

While this CVE lacks specific MITRE ATT&CK technique mappings, Casky's extended reasoning capabilities would flag the underlying attack patterns as consistent with T1530 (Data from Cloud Storage) and T1526 (Cloud Service Discovery) behaviors. A practitioner using Casky would identify suspicious patterns in access logs: authenticated users querying or modifying traces outside their permission scope, repeated API calls to `/api/2.0/traces/*` endpoints with successful responses despite authorization policies, or bulk operations on experiments without corresponding permission grants. The `_before_request` handler gap—missing authorization validators specifically for trace endpoints—represents a control bypass detectable through behavioral analysis of API request chains and permission-to-action mismatches. Casky would correlate these signals to recommend immediate patching to 3.14.0+, audit trails review for unauthorized trace access, and validation of experiment-level RBAC implementation across all ML infrastructure.