Executive brief
MLflow is an open-source platform for managing machine learning workflows, including an AI Gateway feature that routes API requests to upstream LLM providers. The gateway accepts API base URLs from users when creating connection secrets, but fails to validate that these URLs point to legitimate external services rather than internal infrastructure. An attacker with any valid login credentials—including read-only accounts—can create a malicious configuration pointing to internal cloud metadata services or other internal resources, then query these services through the gateway proxy endpoint. This could expose sensitive cloud credentials (such as AWS IAM tokens) and other internal information that should never be accessible from outside the network.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) flaw in MLflow's AI Gateway secret creation and proxy functionality. When a user creates a gateway secret via _create_gateway_secret in mlflow/server/handlers.py, the auth_config.api_base parameter is accepted and stored without any validation of scheme, hostname, or IP address ranges. Subsequently, the raw_proxy endpoint in mlflow/server/gateway_api.py constructs HTTP requests to this stored api_base combined with caller-supplied paths and returns the full response body. MLflow has an existing SSRF guard (_validate_webhook_url) that blocks metadata and private IPs, but it is never invoked in the gateway secret/proxy code path. Additionally, the CreateGatewaySecret action lacks a permission-validator mapping, requiring only basic authentication rather than specific scopes, allowing even read-only users to exploit the vulnerability. An attacker can reach internal cloud metadata services and extract sensitive information like IAM credentials. No patch has been released as of the advisory date.
Affected products
- MLflow MLflow >= 3.13.0, <= 3.15.2
Timeline
- 2026-08-05: disclosed: Published to GitHub Advisory Database
- 2026-08-31: advisory: GitHub security review completed