Is CVE-2026-13484 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13484 being exploited in the wild.

How severe is CVE-2026-13484?

Medium severity, with a CVSS score of 5, published 28 June 2026.

Which products and versions are affected?

MLflow MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7.

Is there a fix for CVE-2026-13484?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13484 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13484?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13484: MLflow missing authorization in Label Schema CRUD API

CVE-2026-13484 · Severity: medium · CVSS 5 · Published 2026-06-28

MLflow, a platform for managing machine learning lifecycles, contains a vulnerability in its labeling schema API. This flaw allows users to bypass intended access controls, potentially allowing unauthorized individuals to view or modify experiment data. While the attack is complex to execute, it could lead to unauthorized access to sensitive machine learning project configurations.

Quick answers

Is CVE-2026-13484 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13484 being exploited in the wild.
How severe is CVE-2026-13484?: Medium severity, with a CVSS score of 5, published 28 June 2026.
Which products and versions are affected?: MLflow MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7.
Is there a fix for CVE-2026-13484?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13484 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13484?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862/CWE-863) exists in MLflow's Experiment-scoped Label Schema CRUD API. The vulnerability stems from a lack of authentication handlers in a specific pull request (PR #23607) that was merged or partially implemented without proper Role-Based Access Control (RBAC) enforcement. A remote attacker with low privileges can exploit this to bypass experiment-level access restrictions. The attack is considered high complexity because it requires specific knowledge of the unreleased or experimental API endpoints. Developers have indicated that authorization handlers were planned for a subsequent release.

Affected products

MLflow MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7

Timeline

2026-06-28: disclosed: Public disclosure of the vulnerability and associated GitHub issue.
2026-06-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.