mlflow up to 3.10.x ENV_VAR insertion of sensitive information into sent data

Summaryinfo

A vulnerability was found in mlflow up to 3.10.x. It has been rated as problematic. This affects an unknown part. This manipulation of the argument ENV_VAR causes insertion of sensitive information into sent data. This vulnerability is registered as CVE-2026-4035. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in mlflow up to 3.10.x and classified as problematic. Affected by this vulnerability is an unknown function. The manipulation of the argument ENV_VAR with an unknown input leads to a insertion of sensitive information into sent data vulnerability. The CWE definition for the vulnerability is CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. As an impact it is known to affect confidentiality. The summary by CVE is:

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream `api_base`. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without `basic-auth`. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0.

It is possible to read the advisory at huntr.com. This vulnerability is known as CVE-2026-4035 since 03/12/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 3.11.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34068). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• mlflow

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion