CVE-2026-71211 Details
Description
MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body.
A vulnerability exists in MLflow's AI Gateway feature, specifically in version 3.14.0. The issue arises because the gateway accepts an 'api_base' value without validating the scheme, host, or IP range. This unvalidated value is stored and later used to issue HTTP requests through a proxy endpoint, bypassing existing safeguards against server-side request forgery (SSRF). As a result, any authenticated user can create a gateway secret that points to an internal address, potentially exposing sensitive information such as cloud-instance IAM credentials via metadata services.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mlflow/mlflow/tree/v3.14.0/mlflow | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| MLflow | >= 3.14.0, < 3.14.0-rc0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |