{"data":{"id":"7997461c-efb6-49a2-8b68-7b28dbc0ee08","title":"CVE-2026-8147: In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper…","summary":"CVE-2026-8147 affects MLflow versions prior to 3.14.0 when authentication is enabled. The trace API endpoints lack proper authorization validators because the `_before_request` handler does not register them, so any authenticated user can bypass experiment-level access controls to read, delete, or modify traces on experiments they cannot access. The flaw can expose sensitive data, destroy audit logs, and enable unauthorized changes.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8147","publishedAt":"2026-07-02T09:16:19.100Z","cveId":"CVE-2026-8147","cweIds":["CWE-284"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":[],"issueType":"vulnerability","affectedPackages":["mlflow@>= 2.14.0rc0, < 3.13.0rc0 (fixed: 3.13.0rc0)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MLflow trace API missing authorization checks allowing unauthorized access","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00548,"epssCheckedAt":"2026-10-14T12:12:41.724Z","kevDateAdded":null,"advisoryAliases":["GHSA-2cm6-r77w-6g96"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:47:08.957Z","patchAvailable":true,"disclosureDate":"2026-07-02T09:16:19.100Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}