Description
MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body.
Published: 2026-08-05
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The MLflow AI Gateway allows users to create gateway secrets that store an auth_config.api_base value without validating its scheme, hostname, or IP address. The gateway proxy endpoint later constructs an outbound HTTP request to this stored api_base and appends a caller-supplied path, returning the full response to the requester. Because the application will contact any host specified in the stored url, an attacker can cause the MLflow server to make requests to arbitrary internal or external addresses, creating a Server Side Request Forgery vulnerability (CWE‑918). This can expose internal resources or return sensitive data back to the attacker.

Affected Systems

All MLflow installations that expose the AI Gateway functionality—including the gateway secret creation endpoint and the raw_proxy endpoint—are vulnerable. The flaw exists in the code shown in the v3.14.0 source tree and is present in any version of mlflow:mlflow that lacks input validation for api_base. No specific version range is provided, but the problem is present until a patch is released.

Risk and Exploitability

The CVSS score of 7.1 marks this as a high severity vulnerability. The EPSS score of <1% indicates a currently low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker can trigger the SSRF by sending a request to the gateway proxy endpoint with a crafted path that forces the server to query a malicious api_base, potentially leaking data that the MLflow server can reach.

Generated by OpenCVE AI on August 10, 2026 at 21:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a version of MLflow that includes validation for the api_base field used when creating gateway secrets.
  • Disable the AI Gateway and the raw_proxy endpoint, or restrict access to those endpoints through application‑level authentication and authorization controls until a patch is available.
  • Apply firewall or network segmentation rules to block outbound connections from the MLflow server to untrusted internal IP ranges, limiting the reachability of potential SSRF targets.

Generated by OpenCVE AI on August 10, 2026 at 21:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. MLflow's existing SSRF guard, _validate_webhook_url (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user — including read-only accounts — can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENV_VAR resolution inside the api_key field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the api_base destination itself, unaffected by that fix. MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body.

Mon, 10 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Title mlflow: Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

Wed, 05 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Wed, 05 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Mlflow
Mlflow mlflow
Vendors & Products Mlflow
Mlflow mlflow

Wed, 05 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. MLflow's existing SSRF guard, _validate_webhook_url (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user — including read-only accounts — can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENV_VAR resolution inside the api_key field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the api_base destination itself, unaffected by that fix.
Title mlflow: Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Mlflow Mlflow
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-10T11:45:17.551Z

Reserved: 2026-08-05T06:56:15.799Z

Link: CVE-2026-71211

cve-icon Vulnrichment

Updated: 2026-08-05T13:26:28.373Z

cve-icon NVD

Status : Received

Published: 2026-08-05T08:16:43.367

Modified: 2026-08-10T12:17:24.923

Link: CVE-2026-71211

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T22:00:05Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)