CVE-2026-13484: MLflow Label Schema Missing Authorization Flaw

Technical summary

CVE-2026-13484 addresses missing authorization controls in an unspecified function within MLflow's Experiment-scoped Label Schema CRUD API. The flaw stems from insufficient access control enforcement, enabling authenticated users to bypass role-based or permission-based restrictions. The attack vector is network-accessible (the API is remote-callable), but exploitation demands high attack complexity and low privileges. The vulnerability maps to CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization), indicating both a lack of permission checks and logical authorization flaws. According to project communications, authorization handlers were intended to be added during the review process before release, suggesting this was a known gap at the time of discovery.

Business impact

Organizations using MLflow for experiment tracking and governance face a confidentiality, integrity, and availability risk. A malicious insider or compromised low-privilege account could view, alter, or delete label schemas, disrupting experiment organization, audit trails, and metadata governance. In regulated environments (healthcare, finance), unauthorized modification of experiment metadata could compromise data lineage and reproducibility. The moderate CVSS score reflects that impact is limited to the authenticated user's scope and does not affect the broader system or other users' data directly.

Affected systems

MLflow versions up to commit 4666cffc7912ea606d592fc38d6a75e2935f65e7 are affected. Organizations should verify their current commit hash or version against the project's repository history to determine exposure. The flaw is specific to the label schema functionality; core experiment tracking, model registry, and other MLflow features are not implicated by this CVE.

Exploitability

Exploitation requires valid authentication credentials, making this an insider or post-compromise scenario rather than an unauthenticated attack. The high attack complexity suggests that the attacker must understand the API structure, craft specific requests, and potentially overcome additional environmental factors. Public disclosure has occurred, but no widely distributed exploit tooling is known. The vulnerability is exploitable but does not constitute an easy-to-weaponize flaw suitable for mass attack.

Remediation

Update MLflow to a version that includes authorization handlers in the label schema CRUD API. Verify the specific commit or version tag with the MLflow project's release notes or security advisory. Until patching is possible, restrict API access using network controls (firewall rules, VPC isolation) and enforce strong authentication and session management for MLflow users. Consider auditing recent changes to label schemas and experiment metadata.

Patch guidance

Consult the MLflow project's official repository and release notes to identify the earliest version after commit 4666cffc7912ea606d592fc38d6a75e2935f65e7 that incorporates authorization controls for the label schema API. Apply patches during a maintenance window, verify the deployment in a staging environment, and confirm that label schema permissions are correctly enforced post-upgrade. If running a containerized MLflow deployment, rebuild and redeploy images from updated source.

Detection guidance

Monitor MLflow API logs for unusual activity on label schema endpoints, particularly POST, PUT, and DELETE operations by low-privilege accounts. Check experiment metadata audit logs for unexpected modifications to label schemas. Implement network-level monitoring for unexpected API calls to the experiment-scoped label schema endpoints. Review user access patterns and cross-reference with permissions; discrepancies may indicate exploitation.

Why prioritize this

This vulnerability should be prioritized based on your MLflow deployment's sensitivity and user base. If MLflow is central to your ML operations and is accessed by contractors, service accounts, or untrusted internal users, prioritize patching. However, the moderate CVSS score and requirement for authentication mean this ranks below critical or high-severity flaws. Organizations with strong internal segmentation, limited MLflow user bases, and regular access audits may schedule remediation in the next quarterly patch cycle.

Risk score, explained

The CVSS 3.1 score of 5.0 (Medium) reflects: (1) network accessibility of the API, reducing the barrier to launch an attack; (2) requirement for prior authentication and low privileges, limiting the attacker pool; (3) high attack complexity, meaning exploitation is not trivial; and (4) limited scope of impact—only confidentiality, integrity, and availability of label schema data within a single experiment scope, not system-wide compromise. The score is not amplified by special privileges or user interaction requirements.

Frequently asked questions