Description
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. A reply to the GitHub issue explains, that "[t]he labeling schema PR has not been merged yet. The auth handlers will be added before the release."
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Confidentiality (Vulnerable System)
Low
Integrity (Vulnerable System)
Low
Availability (Vulnerable System)
Low
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
E
Physical
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
E
Physical
RL
X
RC
Changed
Affected products
References
- MISChttps://vuldb.com/vuln/374481
- MISChttps://vuldb.com/vuln/374481/cti
- MISChttps://vuldb.com/cve/CVE-2026-13484
- MISChttps://vuldb.com/submit/837658
- MISChttps://github.com/mlflow/mlflow/issues/23608
- MISChttps://github.com/mlflow/mlflow/issues/23608#issuecomment-4560963877
- MISChttps://github.com/mlflow/mlflow/