CVE-2026-4035: MLflow AI Gateway Environment Variable Credential Exposure

Technical summary

The vulnerability stems from insufficient sanitization of the `api_key` field in MLflow AI Gateway secrets. The system resolves `$ENV_VAR` references at runtime against the MLflow server's environment and forwards the resolved values in HTTP Authorization headers to upstream API endpoints. An attacker can specify a malicious `api_base` URL and inject environment variable references into the `api_key` field, causing MLflow to send unintended credentials to the attacker-controlled destination. The root cause is CWE-201 (Exposure of Sensitive Information Through Output), allowing information disclosure through normal API operations. Authentication requirements vary by deployment configuration: basic-auth deployments require low-privilege credentials, while default deployments are exploitable without authentication.

Business impact

Exposure of cloud service credentials (AWS keys, Azure tokens, or equivalent) creates immediate risk of unauthorized access to artifact repositories, model storage, and training data. Attackers could poison models, inject malicious code, or pivot laterally into cloud environments. For organizations using MLflow to manage AI/ML workflows at scale, this could compromise the integrity of production models and breach data confidentiality across multiple teams. The blast radius extends beyond MLflow itself—compromised cloud credentials may grant access to other services within the same AWS account or cloud tenant.

Affected systems

MLflow versions prior to 3.11.0 are affected. This includes all 3.10.x, 3.9.x, and earlier releases. Organizations running MLflow as a central model registry or AI Gateway for teams should inventory their deployment versions immediately. The vulnerability affects both self-managed and containerized deployments. Users relying on MLflow for production AI/ML orchestration are at highest risk.

Exploitability

Exploitation requires network access to the MLflow API and is straightforward to execute. In default deployments without authentication enabled, any remote attacker can exploit this immediately. In basic-auth deployments, an attacker needs valid low-privilege credentials—potentially obtained through lateral movement, leaked tokens, or compromised contractor accounts. No special tools or advanced techniques are required; standard HTTP requests suffice. The vulnerability does not require user interaction or code execution on the target; it leverages the platform's normal request-handling flow.

Remediation

Upgrade MLflow to version 3.11.0 or later immediately. This is a high-priority patch that eliminates environment variable resolution in API key fields. Organizations should verify that the patched version is deployed across all MLflow servers and cluster nodes. After patching, rotate any cloud credentials that were exposed during the vulnerability window (prioritize AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY if in use). Conduct a secrets audit and refresh authentication tokens for all connected services.

Patch guidance

MLflow 3.11.0 is the confirmed fixed version. Apply this patch to all MLflow instances in your environment. Test the upgrade in a staging environment first, particularly if you have custom gateway configurations. The patch addresses the root cause by preventing environment variable expansion in secret fields. After upgrade, verify your AI Gateway configurations remain functional and that no custom workarounds are relying on the vulnerable behavior. Check MLflow's release notes for any breaking changes or migration guidance.

Detection guidance

Monitor MLflow API audit logs for suspicious requests to the AI Gateway `/v1/config/gateway` or related endpoints, particularly any `POST` or `PUT` requests containing `$ENV_VAR` patterns in the `api_key` field. Look for outbound HTTP requests from MLflow servers to unexpected or external destinations, which may indicate credential exfiltration. If basic-auth is enabled, correlate such requests with low-privilege user accounts. Examine HTTP headers in upstream provider requests for unexpected Authorization header values. For organizations with comprehensive logging, search for environment variable names (AWS_ACCESS_KEY_ID, etc.) appearing in request payloads or headers sent to external hosts. Implement network segmentation to restrict MLflow server egress only to known, trusted provider endpoints.

Why prioritize this

This vulnerability should be patched within days, not weeks. The CVSS 7.7 (HIGH) score reflects high confidentiality impact with network accessibility and low complexity. The exploitability is straightforward, authentication barriers are weak or absent in many deployments, and the consequence—credential exposure—is severe. Unlike vulnerabilities requiring complex exploitation chains, this can be weaponized by moderately skilled attackers with minimal prerequisites. The cross-boundary impact (credentials leading to cloud account compromise) amplifies business risk.

Risk score, explained

The CVSS 3.1 score of 7.7 (HIGH) is driven by: (1) Network-accessible attack vector (AV:N), (2) low attack complexity requiring no special conditions (AC:L), (3) low privilege requirements (PR:L) with unauthenticated variants in default config, (4) high confidentiality impact from credential leakage (C:H), and (5) scope change (S:C) because compromised credentials can affect systems beyond MLflow. The score appropriately reflects the severity; however, in practice, actual risk is context-dependent on whether credentials exposed grant access to sensitive production systems and whether basic-auth or other controls are in place. Organizations running unpatched MLflow without network segmentation face elevated realized risk.

Frequently asked questions