MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration
MLflow
More for MLflow RSS feed for MLflow
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Record
- CVE-2026-4035
- Affects
- MLflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 3, 2026
- Source last modified
- August 14, 2026
Description
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the api_key field in gateway secrets can accept $ENV_VAR references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream api_base. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without basic-auth. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0.
Description quoted from the NVD record.
Who is affected
MLflow, made by LF Projects, is a platform used to build, track and run machine learning and AI models. This flaw affects versions before 3.11.0 and sits in the AI Gateway feature, which stores keys for connecting to AI services. An attacker can trick the server into sending its secret credentials, such as cloud storage keys, to a server the attacker controls. In setups with basic password login turned on, any signed-in user with limited rights can do this. In default setups without that login, anyone can. Stolen keys could let attackers tamper with stored files and run harmful code in other systems. This flaw is rated High.
What to do
- If someone in your organization installed or runs MLflow, ask them to check which version you use. Any version before
3.11.0has this flaw. - The person who runs MLflow should update it to version
3.11.0or later, which fixes this flaw. - Make the update a priority if your MLflow setup does not use password login, because in that setup anyone can use this flaw without signing in.
- If an IT provider or vendor runs MLflow for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of August 14, 2026 and reviewed before publishing.