MLflow AI Gateway: unvalidated api_base in gateway secrets turns the proxy endpoint into an authenticated SSRF

Impact

A user who can create a gateway secret sets auth_config.api_base to any URL - scheme, host and IP range are never checked - and the value is stored as given. The raw_proxy endpoint then issues a request to that base plus a caller-supplied path and returns the full response body to the caller, so this is a readable SSRF, not a blind one. On a GPU cluster the MLflow server usually runs with a workload identity and sits inside the cluster network, so the reachable set includes loopback services on its own pod, internal APIs that were never meant to be exposed, and whatever the node's link-local endpoints serve. The vendor scores confidentiality high and integrity low, which matches read-anything-the-server-can-reach.

Who can reach it

Authenticated MLflow user with enough rights to create a gateway secret (the vendor vector is PR:L), reaching the MLflow server over the network.

What to do

The record links only the MLflow v3.14.0 source tree and names no fixed release, so do not schedule on a version number yet - track the MLflow advisory. In the meantime restrict who can create gateway secrets, and put an egress policy on the MLflow pod that denies loopback, RFC1918 and link-local destinations so the proxy cannot reach internal targets. When a fixed release lands this is an in-place upgrade of the MLflow server process.

References

Related entries

• MLflow (`spark_udf` dir perms): Excessive directory permissionsCVE-2024-27134 · MLflow (`spark_udf` dir perms)High
• NVIDIA NemoClaw: code injection in the migration command gives a local user execution as the tool's privilegesCVE-2026-65082 · NVIDIA NemoClaw for Linux (migration command)High
• llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
• BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
• vLLM: DeepStream backend misclassification skips pixel limits and lets unauthenticated video exhaust GPU decodeCVE-2026-78684 · vLLM (DeepStream GPU decode path, pixel-limit enforcement)Medium