MLflow AI Gateway: Arbitrary Endpoint Flexibility Turns into SSRF

On October 29, 2026, TrendAI's Zero Day Initiative published advisory ZDI-26-847, documenting a Server-Side Request Forgery vulnerability in the MLflow AI Gateway. The flaw, tracked as CVE-2026-71211, allows authenticated users to force the gateway to forward requests to internal endpoints and cloud services, with an impact rated CVSS 7.7. The case highlights how MLOps platforms are inheriting well-established security problems from traditional API gateways.

How the Attack Works: From api_base to SSRF

MLflow AI Gateway lets users configure custom AI endpoints by specifying a base URL in the api_base field. According to the ZDI advisory, "the specific flaw exists within the processing of the api_base field. The issue results from the lack of proper validation of a URI prior to accessing resources." The official pull request #25761 adds a precise technical detail: "A gateway secret's auth_config.api_base was stored verbatim, and the raw proxy route sends caller-supplied paths to it and returns the response body, so any user who could create a secret could reach internal services and cloud metadata endpoints."

The direct concatenation between the stored base URL and user-supplied paths creates a classic SSRF condition. An authenticated attacker could configure api_base to point at an internal service and then use the raw proxy route to extract sensitive information. The server response was returned in full to the caller, completing the information disclosure loop.

The Timeline: From June to Coordinated October Embargo

The vulnerability was reported to the vendor on June 30, 2026. The coordinated advisory release occurred on October 29, 2026, after a nearly four-month embargo that allowed patch development. This cadence reflects the fix's complexity: pull request #25761 added 1,522 lines of code and removed 22, indicating a substantial architectural revision rather than a point fix.

The core of the change is a dual validation. At write time, the system verifies that api_base uses only HTTPS schemes, public IP addresses, and no embedded credentials. At connection time, a dedicated resolver filters private addresses, blocks redirects, and protects against DNS rebinding. The implementation explicitly covers this last vector, as documented in the PR code: "resolver that only returns public addresses, rejects non-canonical literals... covers DNS rebinding."

The Default Change That Breaks On-Premise Deployments

The patch introduces two environment variables that alter the gateway's operational behavior. MLFLOW_GATEWAY_API_BASE_ALLOW_PRIVATE_IPS and MLFLOW_GATEWAY_API_BASE_ALLOWED_SCHEMES let administrators override the default constraints, but require explicit configuration. This change immediately impacts deployments that used Ollama on localhost or internal services not exposed to the internet: after the update, these endpoints stop working until the override is enabled.

The trade-off is clear. The flexibility that made MLflow attractive — the ability to point to any AI service, including those running locally — was the same feature that opened the SSRF attack surface. MLOps platforms now find themselves replicating the same control hierarchies that enterprise API gateways have consolidated over years: secure defaults, configured exceptions, multi-layer validation.

"This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability." — ZDI Advisory ZDI-26-847

What to Do Now

Organizations running MLflow AI Gateway in multi-user configurations must verify the presence of PR #25761 in their deployment. The update requires attention to environment variables, particularly for on-premise environments using internal AI services.

• Verify whether the gateway is exposed to users who are not fully trusted: the authentication required by the exploit does not equal authorization.
• Review existing api_base configurations: any internal or local endpoint configured before the patch is potentially indicative of past exposure.
• Evaluate enabling MLFLOW_GATEWAY_API_BASE_ALLOW_PRIVATE_IPS only after explicitly mapping the legitimate services that require access.
• Monitor logs for anomalous requests to cloud metadata endpoints or internal services previously reachable via the raw proxy route.

Why This Vulnerability Signals a Broader Trend

CVE-2026-71211 fits a recurring pattern: AI infrastructure is replicating, at compressed speed, the security evolution of traditional web services. AI gateways emerge as orchestration components between models and applications; the need for authentication, authorization, and input validation surfaces only when the attack surface becomes evident. MLflow is not an exception, but a sample of a rapidly maturing category.

The unquantified figure is the extent of risk: sources do not specify how many installations run the AI Gateway component, nor do they document in-the-wild exploits. The authenticated nature of the vulnerability reduces the surface compared to an anonymous attack, but in enterprise environments with many gateway users the risk profile changes significantly. The absence of researcher attribution and details on specifically affected versions leaves uncertainty around legacy systems.

Frequently Asked Questions

Does the vulnerability allow remote code execution?

No. The ZDI advisory explicitly classifies the vulnerability as SSRF with information disclosure. No evidence of remote code execution emerges from the available material.

Can I be affected if I don't use the AI Gateway component?

Sources do not document impacts on MLflow installations that do not activate the AI Gateway. The vulnerability is specific to the raw proxy path handled by that component.

Sources

• zerodayinitiative.com
• zerodayinitiative.com
• github.com