CVE-2026-3198: 
NixOS vulnerability analysis and mitigation

CVE-2026-3198 is an improper access control vulnerability in MLflow 3.9.0 that allows any authenticated user to bypass authorization checks on multiple Gateway API 'list' endpoints. When MLflow is deployed with the basic-auth plugin (--app-name basic-auth), the BEFORE_REQUEST_HANDLERS dictionary in mlflow/server/auth/__init__.py omits entries for ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions, leaving these endpoints unprotected. The vulnerability was published on June 2, 2026, and affects only MLflow version 3.9.0. It carries a CVSS v3.0 base score of 6.5 (Medium) (Github Advisory).

The root cause is classified as CWE-284 (Improper Access Control), with an additional estimate of CWE-862 (Missing Authorization). The BEFORE_REQUEST_HANDLERS dictionary, which maps API endpoint names to their pre-request authorization handlers, simply lacks entries for the three Gateway API list operations — ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions. Because no authorization handler is registered for these endpoints, the basic-auth middleware skips permission enforcement entirely, allowing any user who has successfully authenticated (regardless of their role or permission level) to call these endpoints over the network with low complexity and no user interaction required (Github Advisory).

Successful exploitation allows any authenticated MLflow user to enumerate all gateway secrets (including API keys for downstream LLM or ML service providers), endpoint configurations, and proprietary model definitions without possessing the necessary permissions. The confidentiality impact is rated High, as sensitive credentials and intellectual property such as model architectures and routing configurations are exposed. There is no direct integrity or availability impact, but leaked API keys could enable further attacks against connected AI/ML services or cloud providers (Github Advisory).

There is no confirmed public proof-of-concept exploit or evidence of in-the-wild exploitation at this time. The Huntr bounty report (https://huntr.com/bounties/e57db731-97d3-40c3-a429-831ee959807f) was analyzed and found to contain no exploitable content. The EPSS score is approximately 0.025–0.028%, placing it in the 8th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no threat actor attribution has been reported (Github Advisory).

1. Authentication: Obtain any valid MLflow user account — even a low-privileged one — on a target MLflow 3.9.0 instance running with --app-name basic-auth.
2. Identify target endpoints: Determine the MLflow server's base URL and confirm it is running version 3.9.0 with the basic-auth plugin enabled.
3. Call unprotected list endpoints: Send authenticated HTTP GET/POST requests to the Gateway API list endpoints (e.g., those corresponding to ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions) using standard MLflow client libraries or direct HTTP calls with valid session credentials.
4. Enumerate sensitive data: Parse the API responses to extract API keys (gateway secret infos), endpoint routing configurations, and proprietary model definitions that the authenticated user would not normally be permitted to view.
5. Leverage exfiltrated data: Use harvested API keys to access downstream ML/LLM services, or use model definitions and endpoint configurations for competitive intelligence or further targeted attacks (Github Advisory).

• Network: Unusual or repeated HTTP requests to MLflow Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) from user accounts that do not normally access these resources; bulk enumeration patterns (many list requests in short succession) from a single authenticated user.
• Logs: MLflow access logs showing successful (HTTP 200) responses to Gateway API list endpoints for users with low or restricted permission levels; access to these endpoints outside of normal business hours or from unexpected IP addresses.
• Application: Unexpected downstream API usage or authentication attempts against connected ML/LLM services using credentials stored as MLflow gateway secrets, potentially indicating that exfiltrated API keys are being used.

A patch is available — users should upgrade MLflow from version 3.9.0 to a patched release that includes authorization checks for the ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions endpoints in the BEFORE_REQUEST_HANDLERS dictionary. As an interim workaround, restrict network access to the MLflow Gateway API endpoints to trusted networks or specific user groups using firewall rules or a reverse proxy with additional authentication controls. Administrators should also review MLflow access logs to identify any unauthorized enumeration of gateway secrets or endpoints that may have already occurred (Github Advisory).