This vulnerability in mlflow versions prior to 3.11.0 allows the resolution of environment variables in gateway secrets, enabling attackers to receive sensitive server‑side credentials through the MLflow server’s environment. The resolved values are transmitted in provider authentication headers to the configured upstream `api_base`, potentially exposing cloud artifact credentials such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. The flaw can lead to artifact poisoning and cross‑boundary code execution in downstream environments.

The affected product is mlflow mlflow; any installation running a version earlier than 3.11.0 is vulnerable. The issue occurs when the AI Gateway is configured to use gateway secrets that contain `$ENV_VAR` references, and the MLflow server is running with the capability to resolve those variables.

The CVSS score is 9.1, indicating a high severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw as low‑privileged authenticated users in basic‑auth deployments or even unauthenticated users in default deployments that do not use basic‑auth. Given the high impact and the ability for attackers to exfiltrate credentials to an attacker‑controlled endpoint, the risk is significant and the likelihood of exploitation is high for exposed systems.