Is CVE-2026-3198 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3198 being exploited in the wild.

How severe is CVE-2026-3198?

Medium severity, with a CVSS score of 6.5, published 2 June 2026.

Which products and versions are affected?

mlflow (PyPI) < 3.11.0rc0, ECOSYSTEM:introduced=0,fixed=3.11.0rc0.

Is there a fix for CVE-2026-3198?

Yes. mlflow (PyPI): upgrade to 3.11.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3198 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3198?

Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3198: MLflow improper access control in Gateway API list endpoints

Q: Which products and versions are affected?

mlflow (PyPI) < 3.11.0rc0, ECOSYSTEM:introduced=0,fixed=3.11.0rc0.

Q: Is there a fix for CVE-2026-3198?

Yes. mlflow (PyPI): upgrade to 3.11.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-3198 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-3198?

Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3198 · Severity: medium · CVSS 6.5 · Published 2026-06-02

MLflow is an open-source platform for managing machine learning lifecycles. A security flaw in its authentication system allows any logged-in user to view sensitive configuration details they should not have access to, including API keys, model definitions, and server endpoints. This could lead to the exposure of proprietary AI models or unauthorized access to third-party services via stolen credentials.

Technologies: mlflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-3198 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3198 being exploited in the wild.
How severe is CVE-2026-3198?: Medium severity, with a CVSS score of 6.5, published 2 June 2026.
Which products and versions are affected?: mlflow (PyPI) < 3.11.0rc0, ECOSYSTEM:introduced=0,fixed=3.11.0rc0.
Is there a fix for CVE-2026-3198?: Yes. mlflow (PyPI): upgrade to 3.11.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3198 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3198?: Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mlflow (PyPI): upgrade to 3.11.0rc0 or later
```
pip install "mlflow>=3.11.0rc0"
```

Technical details

An improper access control vulnerability (CWE-284) exists in MLflow 3.9.0 when configured with basic authentication (`--app-name basic-auth`). The root cause is the omission of specific Gateway API endpoints—`ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`—from the `BEFORE_REQUEST_HANDLERS` authorization dictionary in `mlflow/server/auth/__init__.py`. A network-based attacker with low-privileged authenticated access can bypass intended permission restrictions to enumerate sensitive metadata and credentials. This issue is addressed in version 3.11.0rc0.

Affected products

MLflow MLflow 3.9.0

Identifiers

CVE-2026-3198
GHSA-r5m9-wm49-959f
PYSEC-2026-2659

Timeline

2026-02-19: other: Fix commit pushed to repository
2026-06-02: disclosed: Vulnerability published to NVD and GitHub Advisory Database
2026-07-09: advisory: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.