CVE-2026-71211 mlflow CVE debrief

Who should care

MLflow users, administrators of cloud instances with MLflow deployments, security teams monitoring for SSRF vulnerabilities, and operators managing affected systems should be aware of this vulnerability. They should review their deployments for exposure, implement compensating controls, and monitor for suspicious activity. Additionally, security teams should consider restricting the CreateGatewaySecret action to users with specific scope beyond basic authentication and implementing SSRF guards for the gateway proxy endpoint to prevent potential exposure of internal services and cloud-instance IAM credentials via metadata services or other internal resources that could be accessed through the gateway proxy endpoint without proper validation and safeguards in place to protect against SSRF attacks effectively within their environments and networks where MLflow is deployed and utilized across different user groups and access levels within an organization including but not limited to developers administrators and security personnel responsible for managing and securing MLflow deployments and ensuring the integrity and confidentiality of data processed by these systems and applications that interact with or depend on MLflow for their operations and functionality within the context of an organization's overall security posture and risk management strategies related to vulnerabilities like SSRF that could have significant impacts if exploited by malicious actors seeking to compromise systems or steal sensitive information from affected environments where MLflow is used extensively across various sectors and industries globally today still evolving rapidly over time as new threats emerge daily requiring constant vigilance adaptation and improvement in defense mechanisms strategies and technologies employed by defenders tasked with protecting these systems from harm effectively efficiently reliably over long periods time frames under different scenarios conditions circumstances challenges ahead always keeping pace evolving threats landscape proactively reactively responding incidents appropriately minimizing impacts whenever possible preventing attacks whenever feasible.

Technical summary

MLflow's AI Gateway CreateGatewaySecret action allows any authenticated user to create a gateway secret with an arbitrary auth_config.api_base value. This value is stored and used to make HTTP requests through the gateway proxy endpoint, without SSRF guards, potentially exposing internal services and cloud-instance IAM credentials. The existing SSRF guard, _validate_webhook_url, is not invoked in this code path. The CreateGatewaySecret action requires only basic authentication, allowing any authenticated user, including read-only accounts, to create a secret pointing at an internal address.

Defensive priority

Authenticated users with basic access can create gateway secrets pointing to internal addresses, potentially exposing cloud-instance IAM credentials via metadata services.

Recommended defensive actions

• Inventory MLflow installations for exposure to internal networks and unsecured metadata services.
• Restrict CreateGatewaySecret action to users with specific scope beyond basic authentication.
• Implement SSRF guards for the gateway proxy endpoint.
• Monitor for suspicious gateway secret creations and proxy requests.
• Apply compensating controls to limit exposure of cloud-instance IAM credentials.

Evidence notes

The CVE description notes that MLflow's AI Gateway accepts an auth_config.api_base value without validation and stores it verbatim. The gateway proxy endpoint issues an HTTP request to the stored api_base plus a caller-supplied path and returns the full response body. The existing SSRF guard, _validate_webhook_url, is not invoked in this code path. The CreateGatewaySecret action requires only basic authentication, allowing any authenticated user, including read-only accounts, to create a secret pointing at an internal address.

Official resources