CVE-2026-3198: MLflow basic-auth flaw lets any user list Gateway secrets and endpoints

Summary

MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) does not enforce authorization checks on the Gateway API 'list' endpoints. The `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` lacks entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. Any authenticated user can therefore enumerate gateway secrets, endpoints, and model definitions regardless of assigned permissions, exposing items such as API keys and endpoint configurations.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Related items

• MediumChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationSimilar attack · Check Point Research
• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
• LowExtracting System Prompt of LLM Services in Complex (Agentic) Settings: Hierarchical Optimization and Reliable Evaluation MetricsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement StudySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumHow We Took Over ChatGPT AccountsSimilar attack · Simon Willison's Weblog