The vulnerability in MLflow's AI Gateway involves the acceptance and storage of an unvalidated auth_config.api_base value when creating a gateway secret. This value is later used by the gateway proxy endpoint to make HTTP requests to arbitrary destinations combined with a caller-supplied path, without invoking the existing SSRF guard that blocks non-global and metadata IPs. The CreateGatewaySecret action lacks specific permission validation and requires only basic authentication, enabling any authenticated user, including those with read-only access, to create secrets pointing to internal addresses. This can lead to server-side request forgery (SSRF) attacks, potentially exposing sensitive cloud-instance IAM credentials via metadata services. This issue is distinct from CVE-2026-4035, which addresses a different credential leakage mechanism in the same feature.

An attacker with any authenticated access, including read-only users, can create a gateway secret with a malicious api_base value pointing to internal or sensitive network addresses. This can be exploited via the gateway proxy endpoint to perform SSRF attacks, potentially exposing sensitive information such as cloud instance IAM credentials from metadata services. The vulnerability allows unauthorized internal network access and information disclosure, impacting confidentiality with high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to prevent unauthorized creation of gateway secrets. Monitor for unusual gateway secret creation activity and avoid exposing the gateway proxy endpoint to untrusted users. Follow vendor guidance once an official fix or update is released.