Executive brief
MLflow is an open-source platform for managing machine learning lifecycles. A security flaw in its authentication system allows any logged-in user to view sensitive configuration details they should not have access to, including API keys, model definitions, and server endpoints. This could lead to the exposure of proprietary AI models or unauthorized access to third-party services via stolen credentials.
Technical details
An improper access control vulnerability (CWE-284) exists in MLflow 3.9.0 when configured with basic authentication (`--app-name basic-auth`). The root cause is the omission of specific Gateway API endpoints—`ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`—from the `BEFORE_REQUEST_HANDLERS` authorization dictionary in `mlflow/server/auth/__init__.py`. A network-based attacker with low-privileged authenticated access can bypass intended permission restrictions to enumerate sensitive metadata and credentials. This issue is addressed in version 3.11.0rc0.
Affected products
- MLflow MLflow 3.9.0
Timeline
- 2026-02-19: other: Fix commit pushed to repository
- 2026-06-02: disclosed: Vulnerability published to NVD and GitHub Advisory Database
- 2026-07-09: advisory: GitHub Advisory reviewed and updated