CVE-2026-4035: 
NixOS vulnerability analysis and mitigation

CVE-2026-4035 is a credential exfiltration vulnerability in MLflow's AI Gateway that allows environment variable references in the api_key field of gateway secrets to be resolved and transmitted to attacker-controlled endpoints. It affects all mlflow/mlflow versions prior to 3.11.0. The vulnerability was published on June 3, 2026, and fixed in version 3.11.0. It carries a CVSS v3.1 base score of 7.7 (High) per NVD, though the GitHub Advisory Database and ENISA rate it as 9.1 (Critical) using a slightly different vector that includes integrity and availability impacts (Github Advisory, Feedly).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). The api_key field in MLflow AI Gateway secrets accepts $ENV_VAR-style references, which are resolved against the MLflow server's runtime environment without adequate access controls. When a gateway route is configured with a malicious api_base URL and an api_key referencing a sensitive environment variable (e.g., $AWS_SECRET_ACCESS_KEY), the resolved credential is transmitted in provider authentication headers to the attacker-controlled endpoint. The fix, committed in mlflow@4a3f2f7, gates environment variable resolution behind a new opt-in flag MLFLOW_GATEWAY_RESOLVE_API_KEY_FROM_ENV, which defaults to False, so the feature is disabled unless explicitly enabled for the legacy YAML-config gateway (Github Advisory, MLflow Commit).

Successful exploitation allows an attacker to exfiltrate sensitive server-side environment credentials — including cloud credentials such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY — to an attacker-controlled endpoint. In default MLflow deployments (without basic-auth), this is exploitable by unauthenticated users; in basic-auth deployments, any low-privileged authenticated user can trigger the exfiltration. Stolen cloud credentials could enable artifact poisoning, unauthorized access to cloud resources, and cross-boundary code execution in downstream ML pipeline environments, significantly expanding the blast radius beyond the MLflow server itself (Github Advisory, Feedly).

A proof-of-concept exploit with detailed steps is publicly available via the Huntr bug bounty platform (Huntr PoC). Feedly classifies the exploit confidence as high and notes it is a real exploit. The EPSS score is approximately 0.28%, indicating a relatively low but non-negligible probability of exploitation in the near term. There is no current evidence of in-the-wild exploitation, and the vulnerability has not been added to the CISA KEV catalog as of the time of this report (Feedly, Github Advisory).

1. Reconnaissance: Identify an exposed MLflow AI Gateway instance (default deployments without basic-auth are accessible without credentials; basic-auth deployments require any valid low-privileged account).
2. Craft malicious gateway route configuration: Prepare a gateway route configuration that sets api_key to a $-prefixed environment variable reference (e.g., $AWS_SECRET_ACCESS_KEY) and sets api_base to an attacker-controlled server (e.g., https://attacker.example.com/capture).
3. Register the malicious route: Submit the crafted configuration to the MLflow AI Gateway API to create or update a gateway route.
4. Trigger credential resolution: Send a request through the malicious gateway route. MLflow resolves the $ENV_VAR reference against the server's runtime environment and includes the resolved value in the Authorization or API key header of the upstream request.
5. Capture exfiltrated credentials: The attacker-controlled server receives the HTTP request containing the resolved secret (e.g., the actual AWS secret access key) in the authentication header.
6. Leverage stolen credentials: Use the exfiltrated cloud credentials to access AWS resources, poison ML artifacts, or pivot to downstream environments (Huntr PoC, Github Advisory).

• Network: Outbound HTTP/HTTPS requests from the MLflow server to unexpected or external endpoints, particularly those carrying Authorization or x-api-key headers containing high-entropy strings; connections to newly registered or suspicious domains from the MLflow process.
• Logs: MLflow gateway access logs showing creation or modification of gateway routes with api_base values pointing to external or non-standard endpoints; requests to gateway routes that result in outbound calls to unknown hosts.
• Configuration: Gateway secret configurations containing api_key values prefixed with $ referencing sensitive environment variables such as $AWS_ACCESS_KEY_ID, $AWS_SECRET_ACCESS_KEY, or other credential-bearing env vars.
• Cloud/Infrastructure: Unexpected API calls to AWS, GCP, or Azure using credentials associated with the MLflow server's service account, particularly from IP addresses not belonging to the MLflow server; CloudTrail or equivalent logs showing access from unfamiliar IPs using MLflow server credentials (Github Advisory, Feedly).

Upgrade MLflow to version 3.11.0 or later, which disables environment variable resolution in api_key fields by default (requiring explicit opt-in via the MLFLOW_GATEWAY_RESOLVE_API_KEY_FROM_ENV=true environment variable for legacy YAML-config gateways only). For deployments that cannot be immediately upgraded, implement network egress controls to restrict outbound connections from the MLflow server to only trusted, known endpoints, preventing exfiltration to attacker-controlled servers. Additionally, audit all existing gateway route configurations for api_key values beginning with $ and replace them with literal API key values or file-based references (MLflow Commit, Github Advisory).

The vulnerability was disclosed via the Huntr AI bug bounty platform and received coverage on Mastodon security feeds shortly after publication. No major vendor statements beyond the MLflow project's own patch commit have been identified. The ENISA European Vulnerability Database (EUVD) catalogued the issue as EUVD-2026-34068 with a higher severity score of 9.1, reflecting broader integrity and availability concerns beyond the NVD's 7.7 rating (Feedly, Huntr PoC).