TI-2026-02762 Aliases CVE-2026-3198 GHSA-r5m9-wm49-959f

Improper Access Control in mlflow/mlflow

MEDIUM 62CWE-284Published 2026-06-02 · Updated 2026-06-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00244 15th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial mlflow (PyPI): 3.11.0rc0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MLflow	mlflow/mlflow	up to latest	—	No fix listed	CNA
—	mlflow (PyPI)	before 3.11.0rc0	3.11.0rc0	Patch available	GHSA-r5m9-wm49-959f

mlflow/mlflow VendorMLflow Affected up to latest Fixed in — No fix listed CNA
mlflow (PyPI) Vendor— Affected before 3.11.0rc0 Fixed in 3.11.0rc0 Patch available GHSA-r5m9-wm49-959f

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lfprojects:mlflow:3.9.0:-::::::	3.9.0	Vulnerable	MLflow

cpe:2.3:a:lfprojects:mlflow:3.9.0:-:*:*:*:*:*:* Versions 3.9.0 Vulnerable ·MLflow

Remediation

Fix · GHSA-r5m9-wm49-959f mlflow (PyPI) Fixed in 3.11.0rc0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-3198
2026-10-03 Alias added: GHSA-r5m9-wm49-959f

References

Exploit 1

https://huntr.com/bounties/e57db731-97d3-40c3-a429-831ee959807f

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-3198

Other 2

TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
TI-2023-05540 MLflow Authentication Bypass CVSS 3.1CRITICAL 9.8
TI-2023-02603 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8

See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences