The vulnerability resides in MLflow 3.9.0’s authentication handling; missing request‑handler entries for ListGatewaySecretInfos, ListGatewayEndpoints and ListGatewayModelDefinitions allow any authenticated user to retrieve all gateway secrets, endpoints and model definitions. This results in disclosure of sensitive information such as API keys, endpoint configurations and proprietary model definitions that may contain confidential or proprietary data. The flaw is an improper access control weakness that permits broader data exposure than intended.

This issue applies to the open‑source MLflow project, specifically version 3.9.0 when running with the Basic Auth application mode (--app-name basic-auth). No other releases are listed as affected, so the risk scope is limited to that particular build with the insecure authentication configuration.

The CVSS score of 6.5 classifies the vulnerability as medium severity. The EPSS score is < 1%, and KEV is not listed in the CISA catalog, indicating no documented exploitation. The required attack vector is an authenticated session; any user with valid credentials—regardless of role—can enumerate gateway data. While the flaw does not grant code execution, the leakage of secrets and configuration information poses a substantial confidentiality risk and could be leveraged in subsequent attacks.