MLflow AI Gateway: unvalidated api_base in gateway secrets turns the proxy endpoint into an authenticated SSRF

Impact

A user who can create a gateway secret sets auth_config.api_base to any URL - scheme, host and IP range are never checked - and the value is stored as given. The raw_proxy endpoint then issues a request to that base plus a caller-supplied path and returns the full response body to the caller, so this is a readable SSRF, not a blind one. On a GPU cluster the MLflow server usually runs with a workload identity and sits inside the cluster network, so the reachable set includes loopback services on its own pod, internal APIs that were never meant to be exposed, and whatever the node's link-local endpoints serve. The vendor scores confidentiality high and integrity low, which matches read-anything-the-server-can-reach.

Who can reach it

Authenticated MLflow user with enough rights to create a gateway secret (the vendor vector is PR:L), reaching the MLflow server over the network.

What to do

The record links only the MLflow v3.14.0 source tree and names no fixed release, so do not schedule on a version number yet - track the MLflow advisory. In the meantime restrict who can create gateway secrets, and put an egress policy on the MLflow pod that denies loopback, RFC1918 and link-local destinations so the proxy cannot reach internal targets. When a fixed release lands this is an in-place upgrade of the MLflow server process.

References

Related entries

• Hugging Face tokenizers: crafted tokenizer.json aborts the process while loading a BPE modelCVE-2026-85670 · Hugging Face tokenizers (BpeBuilder::build, BPE merge loading)High
• Jupyter Server: Referer header is logged unscrubbed, leaking auth tokens into server logsCVE-2026-86049 · Jupyter Server (5xx request logging in jupyter_server/log.py)High
• n8n OpenAI Chat Model node: model-search path ignores credential domain limits and leaks the API keyCVE-2026-86082 · n8n OpenAI Chat Model node (LMChatOpenAi loadModels.ts model-search path)High
• vLLM: forged FLAC sample rate bypasses duration limit and crashes the API serverCVE-2026-90555 · vLLM (OpenAI-compatible transcription endpoint, audio header validation)High
• Hugging Face Transformers: path traversal in save_pretrained() writes files outside the save directoryCVE-2026-9856 · Hugging Face Transformers - save_pretrained() in PreTrainedTokenizerBase and ProcessorMixinHigh
• MLflow (`spark_udf` dir perms): Excessive directory permissionsCVE-2024-27134 · MLflow (`spark_udf` dir perms)High