Vulnerability · Published Jun 2, 2026 · Assigned by @huntr_ai
CVE-2026-3198Improper Access Control in mlflow/mlflow
Medium 6.5
In plain English
A medium-severity improper access control in mlflow/mlflow from mlflow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mlflow | 3.11.0rc0 | GHSA-r5m9-wm49-959f |
| PyPI | mlflow | 3.11.0rc0 | PYSEC-2026-2659 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mlflow | mlflow/mlflow | unspecified – through latest |
Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N