CVE-2026-13484

MEDIUM

MLflow Experiment-scoped Label Schema CRUD API authorization

Title source: cna
STIX 2.1

Description

A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. A reply to the GitHub issue explains, that "[t]he labeling schema PR has not been merged yet. The auth handlers will be added before the release."

References (7)

Core 7
Core References
Vdb Entry vdb-entry
VDB-374481 | MLflow Experiment-scoped Label Schema CRUD API authorization
https://vuldb.com/vuln/374481
Signature, Permissions Required signature permissions-required
VDB-374481 | CTI Indicators (IOB, IOC)
https://vuldb.com/vuln/374481/cti
Third Party Advisory third-party-advisory
CVE-2026-13484 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-13484
Third Party Advisory third-party-advisory
Submit #837658 | MLflow Unreleased development code in pull request #23607, commit 4666cffc7912ea606d592fc38d6a75e2935f65e7. No released MLflow version CWE-862 Missing Authorization
https://vuldb.com/submit/837658
Exploit exploit issue-tracking
https://github.com/mlflow/mlflow/issues/23608

Scores

CVSS v3 5.0
EPSS 0.0026
EPSS Percentile 17.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-862 CWE-863
Status published
Products (2)
None/MLflow 4666cffc7912ea606d592fc38d6a75e2935f65e7
lfprojects/mlflow < 2026-05-26
Published Jun 28, 2026
Tracked Since Jun 28, 2026