During operation of the mlflow server, enabling the basic‑auth application removes permission checks from tracing and assessment endpoints. An authenticated user who normally lacks access to an experiment can therefore read all trace metadata and create new assessments for traces they should not see. This exposes sensitive data about runs and allows tampering with assessment results, potentially misleading downstream analytics or search results.

The flaw affects installations of the MLflow data science platform that enable the basic‑auth app by launching the server with the option --app-name=basic-auth. All releases of MLflow that include this configuration are vulnerable; no specific version is listed, so any deployment running the app in this manner is impacted.

The vulnerability carries a CVSS score of 8.1, indicating high severity, but its EPSS score is below 1 %, suggesting a low likelihood of widespread exploitation at present. It is not cited in the CISA KEV catalog. Exploitation requires only that the attacker be authenticated to the MLflow instance; no additional privileges are needed beyond a standard user account. Because the affected endpoints lack permission checks, the attack surface is straightforward for any authenticated user.