EUVD-2026-53208
GHSA-h7x2-h6g9-p789
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
S:C assigned because the server acts as a confused deputy reaching metadata services outside MLflow's intended security scope; PR:L reflects the basic-authentication-only requirement.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
5DescriptionCVE.org
MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. MLflow's existing SSRF guard, _validate_webhook_url (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user - including read-only accounts - can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENV_VAR resolution inside the api_key field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the api_base destination itself, unaffected by that fix.
AnalysisAI
MLflow's AI Gateway proxy exposes internal network services - including cloud-instance metadata endpoints - to any authenticated user, including read-only accounts, via an unvalidated api_base field in the CreateGatewaySecret endpoint. All MLflow releases through 3.14.0 are affected; the attack requires only basic credentials and no special configuration, making IAM credential theft a realistic outcome for cloud-hosted deployments. No public exploit has been identified at time of analysis, but the two-step attack (create secret, invoke proxy) involves only standard HTTP requests and no technical barrier beyond holding a valid account.
Technical ContextAI
MLflow (cpe:2.3:a:mlflow:mlflow:*:*:*:*:*:*:*:*) is an open-source ML lifecycle management platform whose AI Gateway feature allows operators to configure upstream AI provider endpoints via gateway secrets. The root cause is CWE-918 (Server-Side Request Forgery): the _create_gateway_secret handler in mlflow/server/handlers.py accepts and stores the auth_config.api_base value verbatim with no scheme, host, or IP-range validation. The raw_proxy function in mlflow/server/gateway_api.py subsequently constructs outbound HTTP requests by concatenating this stored api_base with a caller-supplied path and returns the full response body. MLflow does include a dedicated SSRF guard (_validate_webhook_url) that blocks non-global and metadata IP ranges, but it is never invoked anywhere in the gateway-secret or proxy code path. Compounding the issue, the CreateGatewaySecret action is absent from the permission-validator map entirely, so it falls through to basic authentication rather than enforcing any elevated scope, meaning every authenticated principal - including read-only service accounts - can exploit this path. This is tracked separately from CVE-2026-4035, which addresses server-side environment-variable resolution in the api_key field of the same feature.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis - the GitHub reference resolves to the v3.14.0 tree (still the affected version), and no tagged fix release appears in the provided intelligence. Monitor the MLflow GitHub releases and VulDB advisory at https://vuldb.com/vuln/386109 for a patch. Until a fix is available, the most effective compensating control is to block all outbound HTTP connections from the MLflow server host to link-local (169.254.0.0/16), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and loopback (127.0.0.0/8) ranges at the host firewall or cloud security-group level - note this may break legitimate internal AI provider integrations. If the AI Gateway feature is not actively used, disable it entirely at the MLflow configuration level. Additionally, restrict CreateGatewaySecret endpoint access to explicitly authorized admin roles via a reverse proxy ACL until the permission-validator map is corrected upstream. Avoid granting any untrusted or automated account a valid MLflow login while these controls are not in place.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. Rated critical severity (CVSS 9.6), t
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today