CVE-2026-71211
Fixed in a distro release EPSS <1%CVSS 7.1
MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body.
Products: mlflow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | mlflow | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | mlflow | 3.16.0-r0 |
| Chainguard | mlflow-fips | 3.16.0-r0 |
| Wolfi | mlflow | 3.16.0-r0 |