CVE-2026-13484

[CVE catalog]

A flaw was found in MLflow. This vulnerability, located in the Experiment-scoped Label Schema CRUD API, allows a remote attacker to exploit missing authorization. This could lead to unauthorized access or manipulation of data within the affected component. The attack has a high complexity, making it difficult to exploit. mlflow: MLflow: Unauthorized access and data manipulation via missing API authorization This Moderate flaw in MLflow, as deployed in Red Hat OpenShift AI, stems from missing authorization in the Experiment-scoped Label Schema CRUD API. While a remote attacker could potentially manipulate data, the high attack complexity and difficult exploitability reduce the immediate risk. This issue primarily affects specific MLflow components within the OpenShift AI environment. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Medium · CVSS 5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Published

Jun 28, 2026, 8:30:09 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.50% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "mlflow",
      "ecosystem": "cpe",
      "fixed_version": ""
    }
  ]
}