MLflowGHSA-r5m9-wm49-959f
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
Medium6.5CVE-2026-3198 · Published Jun 2, 2026 · updated Jul 13, 2026
MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 3.11.0rc0 | 3.11.0rc0 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-284
- Also known as
- BIT-mlflow-2026-3198, CVE-2026-3198, PYSEC-2026-2659
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 4 | MLflow: Deterministic sampling in dataset digest enables predictable collisions Low3.6Jun 4 | Low3.6 | 3.10.1 |
| Jun 3 | MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltrationCritical9.1Jun 3 | Critical9.1 | 3.11.0 |
| May 26 | MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabledCritical9.0May 26 | Critical9.0 | 3.11.0rc1 |
| May 21 | MLflow: information disclosureMedium6.5May 21 | Medium6.5 | 3.10.0 |
| May 19 | MLflow: origin validation errorCritical9.6May 19 | Critical9.6 | 3.10.0 |
| May 18 | MLFlow Creates a Temporary File With Insecure PermissionsHigh7.0May 18 | High7.0 | 3.11.0 |