EUVD-2026-39984
GHSA-wfp4-8wh2-c48v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to MLflow with low-privilege account
-
DeliveryIdentify label schema CRUD API endpoints in pre-release build
-
ExploitSend unauthorized CRUD request to target endpoint
-
ExecutionBypass absent authorization check
-
ImpactRead, create, modify, or delete experiment label schemas
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) the target MLflow instance is running a development or pre-release build at or before commit 4666cffc7912ea606d592fc38d6a75e2935f65e7 that includes the unmerged label schema CRUD API feature; (2) the attacker holds at least low-level authenticated access to the MLflow instance (PR:L - unauthenticated exploitation is not possible per the CVSS vector); and (3) high attack complexity (AC:H) must be met, likely requiring knowledge of the undocumented API endpoints specific to the pre-release feature. Exploitation is limited by: authenticated access requirement, high complexity, the feature being part of an unmerged PR (not present in standard stable releases), and impact confined to label schema metadata with no code execution or privileged system access implied. |
| Impact | The CVSS 4.0 base score of 1.3 (AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) correctly characterizes this as a low-severity finding despite its remote attack vector. High attack complexity (AC:H) is significant - exploitation is not straightforward and may require specific knowledge of the unmerged API's endpoint structure or behavior. Privileges are required (PR:L), meaning unauthenticated exploitation is not possible. All CIA impacts are rated Low, scoped only to the vulnerable system with no subsequent-system spillover (SC:N/SI:N/SA:N). The E:P modifier confirms publicly available proof-of-concept code, which elevates practical risk slightly above a theoretical finding. No KEV listing exists, and EPSS data was not provided, suggesting no confirmed active exploitation. The most meaningful real-world risk signal is that this affects a pre-release, unmerged feature: deployments running production MLflow releases are likely not exposed unless they are tracking experimental/development branches. Prioritization should be low for standard deployments and moderate only for organizations running development builds from the affected commit range. |
| Exploit ScenarioDerived | An authenticated MLflow user with minimal privileges - such as a data scientist with read-only experiment access - sends crafted HTTP requests to the Experiment-scoped Label Schema CRUD API endpoints on a development or pre-release MLflow instance. Because no authorization checks exist, the attacker can create, modify, or delete label schema configurations for any experiment, potentially corrupting metadata used by other teams or pipelines. A proof-of-concept demonstrating this technique has been publicly disclosed via the GitHub issue referenced in the CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 28, 2026
Missing authorization in MLflow's Experiment-scoped Label Schema CRUD API allows a remote, low-privileged attacker to perform unauthorized read, create, update, or delete operations on label schema resources. The vulnerability stems from a pre-release feature that was disclosed before its authentication handlers were implemented - a GitHub maintainer confirmed: 'The auth handlers will be added before the release.' A proof-of-concept is publicly available via the referenced GitHub issue. Despite network accessibility, the CVSS 4.0 score of 1.3 reflects high attack complexity and limited impact scope, and no CISA KEV listing has been issued.
RemediationAI
No vendor-released patch has been confirmed at time of analysis - the GitHub maintainer response indicates auth handlers will be added prior to the feature's official release, meaning the fix is planned but not yet in a tagged version. Organizations running development or pre-release MLflow builds containing the label schema feature should restrict network access to the MLflow tracking server to trusted, authorized users only, as a compensating control; this reduces the attack surface but does not eliminate the missing authorization flaw. Alternatively, avoid deploying MLflow builds from the affected commit range in shared or multi-tenant environments until a patched release is available. Monitor the GitHub issue at https://github.com/mlflow/mlflow/issues/23608 and the MLflow changelog for a formal patch release. Production deployments using stable MLflow releases are likely not affected and require no immediate action.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MLflow is an open-source platform widely used in data science and MLOps workflows for experiment tracking, model registry, and deployment. The affected component is the Experiment-scoped Label Schema CRUD API, a feature managing label schemas tied to individual MLflow experiments. CWE-862 (Missing Authorization) describes the root cause: the API endpoints perform no authorization checks, meaning any authenticated user can invoke privileged CRUD operations regardless of their intended access level. Per the GitHub thread, this feature exists in an unmerged pull request - the code up to commit 4666cffc7912ea606d592fc38d6a75e2935f65e7 contains the API surface but not the corresponding auth handlers. CPE cpe:2.3:a:n/a:mlflow:*:*:*:*:*:*:*:* covers the affected range with no specific version bound yet assigned.
Know when Mlflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible API requires low-privilege authentication and high complexity; no scope change and all impacts limited to label schema metadata only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. A reply to the GitHub issue explains, that "[t]he labeling schema PR has not been merged yet. The auth handlers will be added before the release."
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking serv
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Exploit-DB