CVE-2026-13484: MLflow Auth Bypass Vulnerability

CVE-2026-13484 Overview

CVE-2026-13484 is a missing authorization vulnerability [CWE-862] in MLflow, the open-source machine learning lifecycle platform maintained by LF Projects. The flaw resides in the Experiment-scoped Label Schema CRUD API, where authorization handlers are absent from the request path. An authenticated remote attacker with low privileges can invoke label schema operations outside their authorization scope. Public disclosure has been made through the project's GitHub issue tracker, and maintainers have acknowledged that authentication handlers will be added before the labeling schema pull request is merged for release.

Critical Impact
Authenticated remote users can perform unauthorized create, read, update, and delete operations against experiment-scoped label schemas, affecting integrity and confidentiality of MLflow experiment metadata.

Affected Products

MLflow (lfprojects mlflow) up to commit 4666cffc7912ea606d592fc38d6a75e2935f65e7
MLflow Experiment-scoped Label Schema CRUD API component
Deployments running the unreleased labeling schema code path

Discovery Timeline

2026-06-28 - CVE-2026-13484 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13484

Vulnerability Analysis

The vulnerability affects an unknown function within the Experiment-scoped Label Schema CRUD API component of MLflow. The API endpoints handling label schema create, read, update, and delete operations do not enforce authorization checks tied to the target experiment. As a result, callers can operate on label schemas without holding the required experiment-level permissions.

According to the maintainer's reply on the GitHub issue, the labeling schema pull request has not yet been merged, and authorization handlers are planned to be added before release. Exploitation requires network access and low-privilege authentication, and the attack is described as high complexity with difficult exploitability.

Root Cause

The root cause is a missing authorization control [CWE-862] on the label schema handler path. The API relies on route registration without invoking the authentication and authorization middleware that gates other experiment-scoped endpoints in MLflow. Any authenticated user who can reach the API can therefore execute schema operations that should be restricted to experiment owners or collaborators.

Attack Vector

An attacker sends HTTP requests to the affected label schema CRUD endpoints over the network. Because the handlers do not consult the experiment permission model, requests targeting arbitrary experiments succeed as long as the caller is authenticated to the MLflow tracking server. This enables tampering with label taxonomies used to annotate training data and experiment runs, which can undermine downstream model evaluation and governance workflows.

No verified proof-of-concept code is available in the public references. See the GitHub Issue #23608 for the maintainer discussion and technical context.

Detection Methods for CVE-2026-13484

Indicators of Compromise

Requests to experiment-scoped label schema CRUD endpoints originating from user accounts that do not own the target experiment
Unexpected creation, modification, or deletion of label schemas across experiments not associated with the requesting principal
Access log entries showing label schema API calls without preceding authorization decisions in audit output

Detection Strategies

Correlate MLflow application logs with the tracking server's user directory to flag label schema operations performed by non-owners
Baseline normal label schema activity per experiment and alert on cross-experiment CRUD patterns from a single account
Review commit 4666cffc7912ea606d592fc38d6a75e2935f65e7 and any downstream forks to confirm whether the labeling schema code path is deployed

Monitoring Recommendations

Enable verbose request logging on the MLflow tracking server and forward logs to a centralized analytics platform
Monitor for anomalous API call volumes against label schema endpoints, especially outside business hours
Track configuration drift in MLflow deployments to detect enablement of the pre-release labeling schema feature

How to Mitigate CVE-2026-13484

Immediate Actions Required

Audit MLflow deployments to confirm whether the unreleased labeling schema code path from commit 4666cffc7912ea606d592fc38d6a75e2935f65e7 or later is in use
Restrict network access to the MLflow tracking server to trusted users and internal networks only
Review recent label schema activity for signs of unauthorized modification across experiments

Patch Information

A formal patch release has not been published at the time of NVD publication. The MLflow maintainers stated in GitHub Comment on Issue #23608 that authorization handlers will be added to the labeling schema code before the pull request is merged and released. Track the GitHub MLflow Repository for the release that ships the authorization handlers.

Workarounds

Do not deploy builds that include the unmerged labeling schema pull request in production environments
Front the MLflow tracking server with an authenticating reverse proxy that enforces per-user experiment access rules
Reduce the population of authenticated MLflow users to the minimum required and rotate credentials for shared service accounts

bash

# Restrict access to the MLflow tracking server at the reverse proxy layer
# Example nginx location block gating label schema endpoints
location ~ ^/api/2\.0/mlflow/experiments/.*/label-schemas {
    auth_request /_authz;
    proxy_pass http://mlflow_backend;
}