Read the docs
TI-2026-03495 Aliases CVE-2026-4035GHSA-g35p-px32-whv6

Environment Variable Resolution Vulnerability in mlflow/mlflow

Priority HIGH 67CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-201.

Summary

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream `api_base`. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without `basic-auth`. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00521 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed mlflow/mlflow (mlflow): 3.11.0mlflow (PyPI): 3.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowmlflow/mlflowbefore 3.11.03.11.0Patch availableCNA
—mlflow (PyPI)before 3.11.03.11.0Patch availableGHSA-g35p-px32-whv6
  • mlflow/mlflow VendorMLflow Affected before 3.11.0 Fixed in 3.11.0 Patch available CNA
  • mlflow (PyPI) Vendor— Affected before 3.11.0 Fixed in 3.11.0 Patch available GHSA-g35p-px32-whv6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*before 3.11.0VulnerableMLflow
  • cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* Versions before 3.11.0 Vulnerable ·MLflow

Remediation

  • Fix · CNA mlflow/mlflow (mlflow) Fixed in 3.11.0
  • Fix · GHSA-g35p-px32-whv6 mlflow (PyPI) Fixed in 3.11.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4035
  2. 2026-10-03 Alias added: GHSA-g35p-px32-whv6
  3. 2026-10-08 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 4

  • TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
  • TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
  • TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-05540 MLflow Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-02603 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences