Loading...
Skip to main content
GeekWala

CVE-2026-4035

CRITICAL

MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration

Published June 3, 2026Updated July 13, 2026Source: osv

Summary

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream `api_base`. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without `basic-auth`. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0.

Remediation

Upgrade to the fixed version using your package manager.

pip
Update mlflow to 3.11.0 or later
pip install "mlflow>=3.11.0"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

PackageEcosystemAffectedFixed In
mlflow
pypi
0.0.1, 0.1.0, 0.2.0, 0.2.1 (+171 more)3.11.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
Low

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

References

Frequently Asked Questions

What is CVE-2026-4035?
MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2026-4035?
CVE-2026-4035 affects mlflow. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-4035 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-g35p-px32-whv6
BIT-mlflow-2026-4035
PYSEC-2026-2222

Related CVEs

  • CVE-2023-6014
    CRITICAL

    MLflow authentication requirement bypass can allow a user to arbitrarily create an account

  • CVE-2023-6974
    CRITICAL

    MLflow Server-Side Request Forgery (SSRF)

  • CVE-2023-6018
    CRITICAL

    Remote Code Execution due to Full Controled File Write in mlflow

  • CVE-2026-64849
    CRITICAL

    MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

  • CVE-2026-2611
    CRITICAL

    MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

  • CVE-2026-64849
    CRITICAL

    MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

  • CVE-2026-2635
    CRITICAL

    MLflow Use of Default Password Authentication Bypass Vulnerability

  • CVE-2026-0596
    CRITICAL

    Mlflow: Command Injection when serving models with enable_mlserver=True

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies