MLflow EUVD-2026-53208

Exploitation requires possession of any valid MLflow account - including read-only accounts - because the CreateGatewaySecret action is absent from MLflow's permission-validator map and falls through to basic authentication with no scope enforcement. The AI Gateway feature must be enabled and accessible (it is part of the standard MLflow server but may be disabled by configuration). The MLflow server host must have network-level access to the targeted internal resource; exploitation is most impactful where the host can reach cloud metadata services (e.g., 169.254.169.254 on AWS/GCP/Azure). What limits exploitation: deployments where the MLflow server is firewalled from metadata and internal network ranges face substantially reduced exposure; on-premise deployments with no sensitive internal HTTP services reachable from the MLflow host may have minimal confidentiality impact even if the endpoint is reachable.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores 7.1 and is broadly accurate: the attack is network-reachable, requires no special complexity, and demands only a valid login. The high confidentiality impact is well-grounded - successful exploitation against cloud-hosted instances can return IAM role credentials from the EC2/GCP/Azure metadata service, potentially enabling lateral movement or full account takeover. The independent analysis below assigns S:C rather than S:U because the MLflow server acts as a confused deputy reaching infrastructure outside its intended security boundary, which raises the independent score to 8.5. No EPSS data was provided in the supplied intelligence; no CISA KEV listing exists; and no POC code has been identified at time of analysis. Despite the absence of observed exploitation, the real-world risk for cloud-deployed MLflow instances is high: attack complexity is low, any valid account suffices, and the payoff (cloud credentials) is significant. On-premise deployments with no sensitive internal services reachable from the MLflow host face meaningfully lower risk.

An attacker holding any valid MLflow account - for example, a read-only service account provisioned for pipeline monitoring - sends a CreateGatewaySecret POST request with auth_config.api_base set to http://169.254.169.254/. The attacker then calls the raw_proxy endpoint with the path /latest/meta-data/iam/security-credentials/<role-name>, causing the MLflow server to fetch the AWS metadata endpoint and return the temporary IAM credentials in the response body. No public exploit code has been identified at time of analysis, but the entire attack requires only two standard HTTP requests with no special tooling.