- CVSS
- MEDIUM · 5v3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
- Published
- 2026-06-28
- Weakness
- CWE-862, CWE-863
- Source
- nvd.nist.gov/vuln/detail/CVE-2026-13484
Description
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. A reply to the GitHub issue explains, that “[t]he labeling schema PR has not been merged yet. The auth handlers will be added before the release.”
References
How GTK Cyber trains on this
AI security training at GTK Cyber covers the LLM and ML-pipeline vulnerability classes that vulnerabilities like CVE-2026-13484 fall into. Our hands-on courses are taught by Charles Givre and other practitioners who break and defend production AI systems.