A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization.
It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult.
The exploit has been disclosed to the public and may be used. A reply to the GitHub issue explains, that "[t]he labeling schema PR has not been merged yet. The auth handlers will be added before the release."
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Lfprojects Mlflow
cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*
|
— |
<= 2026-05-26
|
References 7
https://github.com/mlflow/mlflow/
cna@vuldb.com
https://github.com/mlflow/mlflow/issues/23608
cna@vuldb.com
https://github.com/mlflow/mlflow/issues/23608#issuecomment-4560963877
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-13484
cna@vuldb.com
https://vuldb.com/submit/837658
cna@vuldb.com
https://vuldb.com/vuln/374481
cna@vuldb.com
https://vuldb.com/vuln/374481/cti
cna@vuldb.com