Description
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. A reply to the GitHub issue explains, that -[t]he labeling schema PR has not been merged yet. The auth handlers will be added before the release.-
CVSS 5EPSS 0.306%Risque 0.51
Voir la source- Publication
- 2026-06-28 09:16:27
- Versions concernées
- unknown
- Type
- Logiciel critique
- Vecteur
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L