CVE-2026-8147: mlflow before 3.14.0 (exclusive); +1 more affected products

Affected technology

mlflow · before 3.14.0 (exclusive)
lfprojects

mlflow/mlflow · unspecified to before 3.14.0
mlflow

Description’s affected range: versions prior to 3.14.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Any authenticated user can bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. Vendor/CNA’s CVSS 3.0 assessment (base score 8.1/10) rates confidentiality and integrity impact as high; availability impact as none.