Description
MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. MLflow's existing SSRF guard, _validate_webhook_url (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user — including read-only accounts — can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENV_VAR resolution inside the api_key field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the api_base destination itself, unaffected by that fix.
Published: 2026-08-05
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

MLflow’s AI Gateway allows an attacker who is authenticated with basic credentials to create a gateway secret that stores an arbitrary api_base value without validation. The gateway proxy then forwards requests to that stored endpoint with no bounds on scheme, host, or IP address. This leads to a Server Side Request Forgery (CWE‑918) that can reach internal services, such as cloud metadata endpoints, potentially leaking sensitive credentials or other protected data. The missing validation is independent of other fixes and means the vulnerability persists until the gateway feature is updated.

Affected Systems

Vulnerable versions of the MLflow project (mlflow:mlflow), particularly releases that include the gateway secret and proxy functionality such as the v3.14.0 branch and earlier. All installations that have enabled the AI Gateway and its proxy endpoints are impacted until a newer release with the validation fix is applied.

Risk and Exploitability

The CVSS score of 7.7 indicates high severity, and the lack of an available EPSS score means the exploitation likelihood is currently unknown. The vulnerability is not listed in CISA’s KEV catalog. Because any authenticated user, even those with read‑only access, can create a gateway secret, the attack vector relies on legitimate user credentials combined with the unrestricted API base. An attacker would need to supply a path to the proxy endpoint, which the application blindly forwards. Successful exploitation could expose internal network resources and cloud IAM credentials, posing a significant risk to confidentiality and integrity of internal assets.

Generated by OpenCVE AI on August 5, 2026 at 08:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest MLflow release where the api_base validation is implemented.
  • Restrict creation of gateway secrets to privileged accounts by configuring authorization checks and removing the basic authentication pathway for this action.
  • Enable network segmentation or firewall rules that block outbound connections from the MLflow server to internal IP ranges, and enforce access control at the gateway proxy level to limit reachability to only approved destinations.

Generated by OpenCVE AI on August 5, 2026 at 08:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Mlflow
Mlflow mlflow
Vendors & Products Mlflow
Mlflow mlflow

Wed, 05 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. MLflow's existing SSRF guard, _validate_webhook_url (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user — including read-only accounts — can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENV_VAR resolution inside the api_key field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the api_base destination itself, unaffected by that fix.
Title mlflow: Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Mlflow Mlflow
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-05T06:59:23.394Z

Reserved: 2026-08-05T06:56:15.799Z

Link: CVE-2026-71211

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T09:15:04Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)