CVE-2026-71211 in MLflow
Summary
by MITRE • 08/05/2026
MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. MLflow's existing SSRF guard, _validate_webhook_url (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user — including read-only accounts — can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENV_VAR resolution inside the api_key field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the api_base destination itself, unaffected by that fix.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability represents a critical server-side request forgery flaw in MLflow's AI Gateway component that stems from insufficient input validation of the auth_config.api_base parameter during gateway secret creation. The technical implementation flaw exists in the mlflow/server/handlers.py file within the _create_gateway_secret function where no validation occurs on the scheme, host, or IP range of the provided api_base value. This stored value is then blindly used by the raw_proxy endpoint in mlflow/server/gateway_api.py without any sanitization or security checks, creating a direct path for attackers to route requests through the MLflow gateway to internal systems.
The operational impact of this vulnerability is severe as it allows authenticated users with minimal privileges to establish gateway secrets pointing to internal network addresses including metadata services. The absence of the _validate_webhook_url function call in the gateway secret/proxy code path removes all existing SSRF protections that would normally block non-global and metadata IP addresses. This gap means that even read-only accounts can exploit the vulnerability by creating secrets that target internal systems, potentially exposing cloud instance IAM credentials through metadata service endpoints. The vulnerability operates at the intersection of CWE-918 Server-Side Request Forgery and CWE-284 Improper Access Control, creating a privilege escalation vector through improper validation.
The security implications extend beyond simple information disclosure as this flaw enables attackers to perform internal reconnaissance and potentially exfiltrate sensitive data from cloud environments. The missing entry in the permission-validator map for CreateGatewaySecret action means that no specific authentication scope is required, making the attack surface accessible to any authenticated user within the system. This aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS where attackers can leverage internal protocols to access restricted resources. The vulnerability is particularly dangerous because it operates independently of CVE-2026-4035, which addressed credential leakage in the api_key field but left this separate validation gap in the api_base parameter unaddressed.
Mitigation strategies should focus on implementing comprehensive input validation for all gateway secret parameters including scheme verification to ensure only https or http protocols are accepted, host validation to restrict connections to specific domains or IP ranges, and IP range checking to prevent access to private network addresses. The _validate_webhook_url function must be integrated into the gateway proxy code path to provide consistent SSRF protection across all gateway operations. Additionally, the permission-validator map should be updated to require appropriate authentication scopes for CreateGatewaySecret actions, ensuring that only users with elevated privileges can create potentially dangerous gateway configurations. Network segmentation and firewall rules should also be implemented to prevent unauthorized access to internal metadata services and critical infrastructure from the MLflow gateway components.