MLflow EUVD-2026-39984

Exploitation requires: (1) the target MLflow instance is running a development or pre-release build at or before commit 4666cffc7912ea606d592fc38d6a75e2935f65e7 that includes the unmerged label schema CRUD API feature; (2) the attacker holds at least low-level authenticated access to the MLflow instance (PR:L - unauthenticated exploitation is not possible per the CVSS vector); and (3) high attack complexity (AC:H) must be met, likely requiring knowledge of the undocumented API endpoints specific to the pre-release feature. Exploitation is limited by: authenticated access requirement, high complexity, the feature being part of an unmerged PR (not present in standard stable releases), and impact confined to label schema metadata with no code execution or privileged system access implied.

The CVSS 4.0 base score of 1.3 (AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) correctly characterizes this as a low-severity finding despite its remote attack vector. High attack complexity (AC:H) is significant - exploitation is not straightforward and may require specific knowledge of the unmerged API's endpoint structure or behavior. Privileges are required (PR:L), meaning unauthenticated exploitation is not possible. All CIA impacts are rated Low, scoped only to the vulnerable system with no subsequent-system spillover (SC:N/SI:N/SA:N). The E:P modifier confirms publicly available proof-of-concept code, which elevates practical risk slightly above a theoretical finding. No KEV listing exists, and EPSS data was not provided, suggesting no confirmed active exploitation. The most meaningful real-world risk signal is that this affects a pre-release, unmerged feature: deployments running production MLflow releases are likely not exposed unless they are tracking experimental/development branches. Prioritization should be low for standard deployments and moderate only for organizations running development builds from the affected commit range.

An authenticated MLflow user with minimal privileges - such as a data scientist with read-only experiment access - sends crafted HTTP requests to the Experiment-scoped Label Schema CRUD API endpoints on a development or pre-release MLflow instance. Because no authorization checks exist, the attacker can create, modify, or delete label schema configurations for any experiment, potentially corrupting metadata used by other teams or pipelines. A proof-of-concept demonstrating this technique has been publicly disclosed via the GitHub issue referenced in the CVE.