Improper Access Control in mlflow/mlflow

published 2026-06-02 5 mo ago modified 2026-09-08 2 mo ago also BIT-mlflow-2026-3198 , EUVD-2026-33880 , GHSA-r5m9-wm49-959f , PYSEC-2026-2659

cvss: 6.5; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits: 0; none known

MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.

Patch / fix

fixed in 2 links 1

pypi mlflow 3.11.0rc0
bitnami mlflow 3.10.0

github.com/mlflow/mlflow@6989066 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-3198 updated 2026-06-08 cvss 6.5

mlflow: MLflow: Information disclosure via insufficient authorization checks in Gateway API endpoints

Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-th06-cpu-torch210-py312-rhel9, rhoai/odh-th06-rocm64-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch210-py312-rhel9, rhoai/odh-training-cuda128-torch29-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, +13 more
affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 5 mo ago (2026-06-02)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

huntr.com https://huntr.com/bounties/e57db731-97d3-40c3-a429-831ee959807f referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	mlflow	<3.11.0rc0	3.11.0rc0
bitnami	mlflow	>=3.9.0, <3.10.0	3.10.0

Affected products

mlflow mlflow/mlflow

Classification

Weakness

CWE-284 Improper Access Control

References

github.com /mlflow/mlflow/commit/6989066af33fdcb03588fd71a1a67f8fc5ef12c9
web
huntr.com /bounties/e57db731-97d3-40c3-a429-831ee959807f
exploit, web, third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2026-3198
advisory, web
github.com /mlflow/mlflow
package
pypi.org /project/mlflow
package
github.com /advisories/GHSA-r5m9-wm49-959f
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary