Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2026-3198 MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API…

Description

MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.

Produits et versions touchés

Produit Versions touchées Corrigé en
mlflow/mlflow Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de mlflow/mlflow

Les 55 CVE de mlflow/mlflow →
CVE-2026-8147 In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper… 8.1 Élevée CVE-2026-4035 A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI… 9.1 Critique CVE-2026-2651 A vulnerability in MLflow… 9.0 Critique CVE-2026-2734 In mlflow/mlflow versions up to 3.9.0, the `SearchModelVersions` REST API endpoint and the `mlflowSearchModelVersions`… 6.5 Moyenne
Suivre cette CVE