Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2aw2-55zh-8kew
Vulnerability ID VCID-2aw2-55zh-8kew
Aliases CVE-2025-15381
GHSA-g6pg-52vf-843h
Summary
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-425 Direct Request ('Forced Browsing')
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-15381.json
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-15381
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-g6pg-52vf-843h
cvssv3.1 8.1 https://github.com/mlflow/mlflow
generic_textual HIGH https://github.com/mlflow/mlflow
cvssv3.1 8.1 https://github.com/mlflow/mlflow/blob/b569ebc74c14af593c326143bee2df44a5d59edf/mlflow/server/auth/__init__.py#L752
generic_textual HIGH https://github.com/mlflow/mlflow/blob/b569ebc74c14af593c326143bee2df44a5d59edf/mlflow/server/auth/__init__.py#L752
cvssv3 8.1 https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c
cvssv3.1 8.1 https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c
generic_textual HIGH https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c
ssvc Track* https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2025-15381
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-15381
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-15381.json
https://api.first.org/data/v1/epss?cve=CVE-2025-15381
https://github.com/mlflow/mlflow
https://github.com/mlflow/mlflow/blob/b569ebc74c14af593c326143bee2df44a5d59edf/mlflow/server/auth/__init__.py#L752
https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c
https://nvd.nist.gov/vuln/detail/CVE-2025-15381
2452341 https://bugzilla.redhat.com/show_bug.cgi?id=2452341
GHSA-g6pg-52vf-843h https://github.com/advisories/GHSA-g6pg-52vf-843h
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-15381.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/mlflow/mlflow
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/mlflow/mlflow/blob/b569ebc74c14af593c326143bee2df44a5d59edf/mlflow/server/auth/__init__.py#L752
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-03-27T16:58:49Z/ Found at https://huntr.com/bounties/149fb2f9-ef4b-4136-a25c-20563451904c
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-15381
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01573
EPSS Score 0.00011
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T22:50:36.651447+00:00 EPSS Importer Import https://epss.cyentia.com/epss_scores-current.csv.gz 38.6.0