CVE-2026-71211: MLflow AI Gateway SSRF via unvalidated api_base

CVE-2026-71211 · Severity: high · CVSS 7.1 · Published 2026-08-05

MLflow is an open-source platform for managing machine learning workflows, including an AI Gateway feature that routes API requests to upstream LLM providers. The gateway accepts API base URLs from users when creating connection secrets, but fails to validate that these URLs point to legitimate external services rather than internal infrastructure. An attacker with any valid login credentials—including read-only accounts—can create a malicious configuration pointing to internal cloud metadata services or other internal resources, then query these services through the gateway proxy endpoint. This could expose sensitive cloud credentials (such as AWS IAM tokens) and other internal information that should never be accessible from outside the network.

Technologies: mlflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-71211 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71211 being exploited in the wild.
How severe is CVE-2026-71211?
High severity, with a CVSS score of 7.1, published 5 August 2026.
Which products and versions are affected?
mlflow (PyPI) >= 3.13.0, <= 3.15.2, ECOSYSTEM:introduced=3.13.0,last_affected=3.15.2.
Is there a fix for CVE-2026-71211?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-71211 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71211?
Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) flaw in MLflow's AI Gateway secret creation and proxy functionality. When a user creates a gateway secret via _create_gateway_secret in mlflow/server/handlers.py, the auth_config.api_base parameter is accepted and stored without any validation of scheme, hostname, or IP address ranges. Subsequently, the raw_proxy endpoint in mlflow/server/gateway_api.py constructs HTTP requests to this stored api_base combined with caller-supplied paths and returns the full response body. MLflow has an existing SSRF guard (_validate_webhook_url) that blocks metadata and private IPs, but it is never invoked in the gateway secret/proxy code path. Additionally, the CreateGatewaySecret action lacks a permission-validator mapping, requiring only basic authentication rather than specific scopes, allowing even read-only users to exploit the vulnerability. An attacker can reach internal cloud metadata services and extract sensitive information like IAM credentials. No patch has been released as of the advisory date.

Affected products

  • MLflow MLflow >= 3.13.0, <= 3.15.2

Identifiers

  • CVE-2026-71211
  • GHSA-h7x2-h6g9-p789
  • PYSEC-2026-3865

Timeline

  • 2026-08-05: disclosed: Published to GitHub Advisory Database
  • 2026-08-31: advisory: GitHub security review completed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.