CVE-2026-13484

A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. A reply to the GitHub issue explains, that "[t]he labeling schema PR has not been merged yet. The auth handlers will be added before the release."

• CWE-862
• CWE-863

• https://github.com/mlflow/mlflow/Product
• https://github.com/mlflow/mlflow/issues/23608Issue Tracking, Third Party Advisory, Exploit
• https://github.com/mlflow/mlflow/issues/23608#issuecomment-4560963877Third Party Advisory, VDB Entry, Exploit, Issue Tracking
• https://vuldb.com/cve/CVE-2026-13484Third Party Advisory, VDB Entry
• https://vuldb.com/submit/837658Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/374481Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/374481/ctiPermissions Required, VDB Entry
• https://github.com/mlflow/mlflow/issues/23608#issuecomment-4560963877Third Party Advisory, VDB Entry, Exploit, Issue Tracking

Published

Jun 28, 2026

Last Modified

Jul 1, 2026

Status

Analyzed

• CVE-2026-13461When coupled with the SSL bypass vulnerability, JavaScript c…9.6
• CVE-2026-13462PayRange Android app, version 7.0.7 and below, contains an S…7.5
• CVE-2026-13468The Visualizer – Tables & Charts Manager with Built-in AI Ge…7.5
• CVE-2026-13474Denial of service via malformed HTTP/2 requests in NetScaler…7.5
• CVE-2026-13482A vulnerability was detected in skypilot-org skypilot up to …3.7
• CVE-2026-13483A flaw has been found in arc53 DocsGPT up to 0.18.0. The aff…3.1
• CVE-2026-13485A vulnerability was found in SourceCodester Class and Exam T…7.3
• CVE-2026-13486A vulnerability was determined in SourceCodester Class and E…7.3
• CVE-2026-13487A vulnerability was identified in SourceCodester Class and E…7.3
• CVE-2026-13488A security flaw has been discovered in SourceCodester Class …7.3
• CVE-2026-13489A weakness has been identified in 78 xiaozhi-esp32 up to 2.2…3.1
• CVE-2026-13490A security vulnerability has been detected in glpi-project g…6.3