This vulnerability arises because the `api_key` field in mlflow/mlflow gateway secrets accepts environment variable references (e.g., $ENV_VAR) that are resolved against the MLflow server's environment at runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream API base. This behavior can be exploited to exfiltrate sensitive environment credentials such as AWS keys. The vulnerability affects versions prior to 3.11.0 and can be exploited by low-privileged authenticated users in basic-auth deployments or unauthenticated users in default deployments without basic-auth. The vulnerability is tracked as CWE-201 (Insertion of Sensitive Information Into Sent Data) and has a CVSS v3.0 score of 9.1 (critical). The issue is fixed in version 3.11.0. The vendor manages remediation for this cloud-hosted service, and the Red Hat advisory confirms the vulnerability and fix.

Exploitation of this vulnerability can lead to leakage of sensitive server-side environment credentials, including cloud artifact credentials such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. This leakage can enable attackers to poison artifacts and potentially execute code across security boundaries in downstream environments. The vulnerability affects confidentiality, integrity, and availability, with high confidentiality impact and partial integrity and availability impact as per the CVSS vector.

A fix is available in mlflow/mlflow version 3.11.0. Users and administrators should upgrade to version 3.11.0 or later to remediate this vulnerability. Since this is a cloud-hosted service, the vendor manages remediation server-side; users should verify with the vendor advisory for confirmation. No additional mitigation steps are indicated by the vendor advisory.