{"id":"PYSEC-2026-3865","summary":" MLflow AI Gateway permits SSRF through an unvalidated api_base","details":"MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. MLflow's existing SSRF guard, _validate_webhook_url (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user — including read-only accounts — can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENV_VAR resolution inside the api_key field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the api_base destination itself, unaffected by that fix.","aliases":["CVE-2026-71211","GHSA-h7x2-h6g9-p789"],"modified":"2026-09-10T12:15:09.110661324Z","published":"2026-09-10T09:44:51.189114Z","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71211"},{"type":"WEB","url":"https://github.com/mlflow/mlflow/commit/96b7d900e14227e0821981409d86f5fb6c59b386"},{"type":"PACKAGE","url":"https://github.com/mlflow/mlflow"},{"type":"WEB","url":"https://github.com/mlflow/mlflow/tree/v3.14.0/mlflow"},{"type":"PACKAGE","url":"https://pypi.org/project/mlflow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-h7x2-h6g9-p789"}],"affected":[{"package":{"name":"mlflow","ecosystem":"PyPI","purl":"pkg:pypi/mlflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.13.0"},{"last_affected":"3.15.2"}]}],"versions":["3.13.0","3.14.0","3.15.0","3.15.1","3.15.2"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/mlflow/PYSEC-2026-3865.yaml"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"}]}