CVE-2026-3198: MLflow 3.9.0 Basic-Auth Authorization Bypass – Gateway API Enumeration

Technical summary

MLflow 3.9.0's basic-auth handler omits authorization enforcement for three Gateway API 'list' operations: ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions. The root cause is missing entries in the `BEFORE_REQUEST_HANDLERS` dictionary within `mlflow/server/auth/__init__.py`. This dictionary is responsible for registering authorization checks that run before request processing. Because these three endpoints lack handler registration, the application skips permission validation and returns full enumeration data to any authenticated principal, regardless of role or assigned scopes. The vulnerability allows horizontal privilege escalation where low-privileged authenticated users gain visibility into resources they should not access.

Business impact

Exposure of gateway secrets and API credentials poses a significant operational risk. Attackers with low-level MLflow access can exfiltrate authentication material and endpoint configurations, enabling lateral movement, unauthorized API calls to downstream services, or credential reuse in supply-chain attacks. Proprietary model definitions and endpoint topologies may also be compromised, leading to competitive intelligence loss. Organizations relying on MLflow's basic-auth for multi-tenant or role-based access control should assume that privilege boundaries have been partially compromised; attackers can map the full MLflow infrastructure and identify high-value targets for further exploitation.

Affected systems

MLflow version 3.9.0 with the `--app-name basic-auth` deployment configuration is affected. Organizations using MLflow in default or alternative authentication modes (LDAP, OIDC, or no authentication) should verify their specific deployment. The vulnerability is specific to the basic-auth handler implementation and does not affect MLflow deployments without authentication or those using other authentication backends. Verify your MLflow version and authentication configuration by checking the deployment startup parameters and the server version endpoint.

Exploitability

Exploitation requires valid authentication credentials—an attacker must already have a user account and be able to log into the MLflow instance. Once authenticated, no additional interaction or technical sophistication is needed; the attacker simply calls the affected list endpoints via the MLflow API. The barrier to exploitation is low from a technical perspective (standard HTTP requests), but access prerequisites limit the attack surface to internal users or attackers who have obtained valid credentials. The CVSS vector reflects this: network-accessible but requiring prior authentication (PR:L).

Remediation

Update MLflow to a patched version that includes authorization handler registration for the three affected endpoints. Verify the exact patched version in the upstream MLflow security advisory or release notes. Until a patch is available, mitigate by restricting MLflow API access via network controls (firewall rules, VPC isolation) or reverse-proxy authentication layers, and audit which users have been granted MLflow accounts. Additionally, rotate all gateway secrets and API keys that may have been exposed, and review logs for suspicious enumeration activity on the affected endpoints.

Patch guidance

Consult the official MLflow release notes and security advisories for the specific patched version addressing CVE-2026-3198. Apply the update to all MLflow instances running version 3.9.0 with basic-auth enabled. Test the patch in a non-production environment first to confirm authorization checks are now enforced for ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions. After deployment, verify that low-privileged users can no longer enumerate sensitive gateway resources.

Detection guidance

Monitor MLflow API audit logs for repeated or anomalous calls to `/api/2.0/gateway/list-secrets`, `/api/2.0/gateway/list-endpoints`, and `/api/2.0/gateway/list-models` (or equivalent endpoints depending on MLflow version). Correlate these calls with user identity and role; any low-privileged account making these requests may indicate exploitation. Configure alerts if a single user account performs a high volume of list operations within a short timeframe. Additionally, check MLflow server logs for missing BEFORE_REQUEST_HANDLERS registrations in the auth initialization output.

Why prioritize this

This vulnerability merits near-term patching despite a MEDIUM CVSS score because it directly undermines the access control model in MLflow deployments. In environments where MLflow manages credentials for downstream ML services or data pipelines, unauthorized secret enumeration creates a direct path to credential compromise. The requirement for prior authentication limits blast radius but does not eliminate risk—internal threats, compromised service accounts, and credential-stuffing attacks all become viable. Organizations should prioritize this patch if they use MLflow's basic-auth with multi-user or multi-tenant configurations.

Risk score, explained

CVSS 6.5 (MEDIUM) reflects high confidentiality impact (C:H)—sensitive secrets and configurations are disclosed—but no integrity or availability impact. The score accounts for the authentication prerequisite (PR:L), which reduces the overall severity. However, the practical risk depends on what secrets are stored in the gateway and whether MLflow is exposed to untrusted internal networks. Organizations with strict network segmentation and minimal multi-user MLflow deployments face lower risk; those with shared MLflow instances and downstream service credentials stored in the gateway face elevated risk.

Frequently asked questions