CVE-2026-71211: mlflow: Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret (mlflow/server/handlers.py, creategatewaysecret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gatewayapi.py, rawproxy) subsequently issues an HTTP request to that stored apibase plus a caller-supplied path and returns the full response body. MLflow's existing SSRF guard, validatewebhookurl (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user — including read-only accounts — can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENVVAR resolution inside the apikey field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the apibase destination itself, unaffected by that fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mlflowto a version that resolves this vulnerability.Patch CVE-2026-4035 - Configuration
In mlflow/server/handlers.py (_create_gateway_secret) and mlflow/server/gateway_api.py (raw_proxy), add validation for auth_config.api_base (scheme/host/IP range) and ensure the existing SSRF guard _validate_webhook_url is invoked for api_base before storing/using it. Reject non-global, metadata, and disallowed IP ranges.
MLflow AI Gateway gateway secret / proxy destination auth_config.api_base validation = validate scheme, host, and IP range (apply SSRF guard to api_base) - Configuration
Add an entry for the CreateGatewaySecret action in the permission-validator map so creating gateway secrets requires the intended scope rather than only basic authentication; ensure read-only users cannot create secrets that target internal addresses.
MLflow AI Gateway CreateGatewaySecret authorization permission-validator map entry = add scope requirement for CreateGatewaySecret - Compensating control
Restrict network egress from the MLflow AI Gateway/proxy component so it cannot reach internal networks/metadata services (e.g., block access to instance metadata IPs/addresses and private IP ranges from the MLflow gateway host).
- Operational
After deploying validation and authorization changes, review and revoke/replace any previously created gateway secrets that may contain unvalidated auth_config.api_base values pointing to internal addresses, since existing secrets are stored verbatim and could remain usable until changed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71211?
The severity of CVE-2026-71211 is rated high with a score of 7.7.
How do I fix CVE-2026-71211?
To fix CVE-2026-71211, ensure proper validation of the api_base input to prevent unrestricted access and potential SSRF attacks.
What type of vulnerability is CVE-2026-71211?
CVE-2026-71211 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What software is affected by CVE-2026-71211?
CVE-2026-71211 affects the MLflow software, specifically versions without proper validations in the AI Gateway.
What is the impact of exploiting CVE-2026-71211?
Exploiting CVE-2026-71211 could allow an attacker to access internal services via the unvalidated gateway proxy.