AIKIDO-2026-441895

TL;DR

Affected versions of this package are vulnerable to missing authorization on trace API endpoints when the MLflow tracking server runs with authentication enabled (--app-name basic-auth). Trace operations such as searching and reading traces, deleting traces, modifying trace tags, and linking traces to runs did not enforce experiment-level permissions. Any authenticated user could access and modify traces from experiments they were not authorized to use, exposing sensitive LLM prompts, responses, function arguments, and audit data. The root cause was missing entries for trace endpoint handlers in the server's BEFORE_REQUEST_VALIDATORS map, so authorization checks were skipped for those routes.