This vulnerability in mlflow versions prior to 3.11.0 allows the resolution of environment variables in gateway secrets, enabling attackers to receive sensitive server‑side credentials through the MLflow server’s environment. The resolved values are transmitted in provider authentication headers to the configured upstream api_base, potentially exposing cloud artifact credentials such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. The flaw can lead to artifact poisoning and cross‑boundary code execution in downstream environments. The flaw is identified as CWE‑201, where credentials are exposed through improper authentication mechanisms.

The affected product is mlflow mlflow; any installation running a version earlier than 3.11.0 is vulnerable. The issue occurs when the AI Gateway is configured to use gateway secrets that contain $ENV_VAR references, and the MLflow server is running with the capability to resolve those variables.

The CVSS score is 7.7, indicating a high severity level. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw as low‑privileged authenticated users in basic‑auth deployments or even unauthenticated users in default deployments that do not use basic‑auth. Given the high impact and the ability for attackers to exfiltrate credentials to an attacker‑controlled endpoint, the risk is significant but the likelihood of exploitation is low to moderate for exposed systems.