This vulnerability arises because the `api_key` field in MLflow AI Gateway secrets can contain environment variable references (e.g., $ENV_VAR) that are resolved against the MLflow server's environment at runtime. The resolved secrets are then sent in authentication headers to the configured upstream API endpoint. An attacker with access to the AI Gateway configuration—either as a low-privileged authenticated user in basic-auth deployments or unauthenticated in deployments without basic-auth—can exploit this to exfiltrate sensitive environment credentials such as AWS keys. This can lead to unauthorized access to cloud resources and potential downstream artifact poisoning or code execution. The vulnerability is fixed in mlflow version 3.11.0. Red Hat advisories confirm the issue and recommend restricting network access and enforcing authentication.

The primary impact is the disclosure of sensitive server-side environment credentials, including cloud artifact credentials (e.g., AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY). This credential leakage can enable attackers to access cloud resources unauthorizedly and potentially poison artifacts or execute code in downstream environments. The vulnerability does not directly allow remote code execution on the MLflow platform but can facilitate secondary attacks. Exploitation requires network access to the AI Gateway and either low-privileged authenticated access or no authentication if basic-auth is disabled.

A fix is available in mlflow version 3.11.0. Users should upgrade to this version to remediate the vulnerability. Additionally, restrict network access to the MLflow server to trusted clients only and ensure that authentication mechanisms such as basic-auth are properly configured and enabled to prevent unauthenticated or low-privileged access. Consult MLflow documentation for configuration details. A restart or reload of the MLflow service may be required after applying changes.