A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environme
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the api_key field in gateway secrets can accept $ENV_VAR references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream api_base. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without basic-auth. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | mlflow | < 3.11.0 | 3.11.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-4035
- https://github.com/mlflow/mlflow/commit/4a3f2f720cb4f058c9e0c5b883e0acc9ab64a7f3
- https://access.redhat.com/security/cve/CVE-2026-4035
- https://bugzilla.redhat.com/show_bug.cgi?id=2484318
- https://github.com/mlflow/mlflow
- https://huntr.com/bounties/f8e591a0-0f19-4910-b82e-16c9956f2233
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4035.json
- https://github.com/advisories/GHSA-g35p-px32-whv6
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N- Weakness (CWE)
CWE-201- Platform
- Python (PyPI)
- Package
mlflow- Disclosed
- 03.06.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - GHSA-g35p-px32-whv6 - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-2222 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: mlflow
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 82
- First → latest
- 02.2022 09.2026
- Without a fix
- 18
- Exploited in attacks
- 1
Severity breakdown
- Critical 20
- High 48
- Medium 13
- Low 1
Disclosures per year
- 2022: 1
- 2023: 22
- 2024: 24
- 2025: 8
- 2026: 27
-
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environme this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.