9.1
CRITICAL
CVSS 3.0
CVE-2026-4035
Environment Variable Resolution Vulnerability in mlflow/mlflow
Overview
Description
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream `api_base`. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without `basic-auth`. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0.
Details
INFO
Published Date :
June 3, 2026, 9:16 a.m.
Last Modified :
July 21, 2026, 7:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.0 | CRITICAL | [email protected] | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c |
Solution
Update MLflow to version 3.11.0 or later to prevent environment variable exfiltration.
- Update MLflow to version 3.11.0 or later.
- Review and restrict access to gateway secrets.
- Monitor for suspicious authentication header activity.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-4035.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-4035 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-4035
weaknesses.
CAPEC-12: Choosing Message Identifier Choosing Message Identifier
CAPEC-217: Exploiting Incorrectly Configured SSL/TLS Exploiting Incorrectly Configured SSL/TLS
CAPEC-612: WiFi MAC Address Tracking WiFi MAC Address Tracking
CAPEC-613: WiFi SSID Tracking WiFi SSID Tracking
CAPEC-618: Cellular Broadcast Message Request Cellular Broadcast Message Request
CAPEC-619: Signal Strength Tracking Signal Strength Tracking
CAPEC-621: Analysis of Packet Timing and Sizes Analysis of Packet Timing and Sizes
CAPEC-622: Electromagnetic Side-Channel Attack Electromagnetic Side-Channel Attack
CAPEC-623: Compromising Emanations Attack Compromising Emanations Attack
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-4035 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-4035 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 21, 2026
Action Type Old Value New Value Added Translation Title: mlflow/mlflow de mlflow, Description: Una vulnerabilidad en las versiones de mlflow/mlflow anteriores a la 3.11.0 permite la resolución de variables de entorno en secretos de AI Gateway, lo que puede ser explotado para exfiltrar credenciales de entorno sensibles del lado del servidor a un punto final controlado por un atacante. Este problema surge porque el campo 'api_key' en los secretos del gateway puede aceptar referencias a '$ENV_VAR', que se resuelven contra el entorno del servidor de MLflow durante el tiempo de ejecución. Los secretos resueltos se envían entonces en los encabezados de autenticación del proveedor al 'api_base' ascendente configurado. Esta vulnerabilidad puede ser explotada por usuarios autenticados con bajos privilegios en implementaciones con 'basic-auth' o por usuarios no autenticados en implementaciones predeterminadas sin 'basic-auth'. El impacto incluye la posible fuga de credenciales sensibles, como credenciales de artefactos en la nube ('AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY'), lo que podría llevar al envenenamiento de artefactos y a la ejecución de código transfronteriza en entornos descendentes. El problema está solucionado en la versión 3.11.0. -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 15, 2026
Action Type Old Value New Value Changed Affected [{'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'defaultStatus': 'affected'}] [{'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-mlflow-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-th06-cpu-torch210-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-th06-cuda130-torch210-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-th06-rocm64-torch291-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-training-cuda128-torch29-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}] -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'defaultStatus': 'affected'}] Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Added CWE CWE-201 Added Reference https://access.redhat.com/security/cve/CVE-2026-4035 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2484318 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4035.json -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-4035', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-03T13:10:20.303201Z'} -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'mlflow', 'product': 'mlflow/mlflow', 'versions': [{'status': 'affected', 'version': 'unspecified', 'lessThan': '3.11.0', 'versionType': 'custom'}]}] -
Initial Analysis by [email protected]
Jun. 04, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Added CPE Configuration OR *cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* versions up to (excluding) 3.11.0 Added Reference Type huntr.dev: https://github.com/mlflow/mlflow/commit/4a3f2f720cb4f058c9e0c5b883e0acc9ab64a7f3 Types: Patch Added Reference Type CISA-ADP: https://huntr.com/bounties/f8e591a0-0f19-4910-b82e-16c9956f2233 Types: Exploit, Third Party Advisory Added Reference Type huntr.dev: https://huntr.com/bounties/f8e591a0-0f19-4910-b82e-16c9956f2233 Types: Exploit, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 03, 2026
Action Type Old Value New Value Added Reference https://huntr.com/bounties/f8e591a0-0f19-4910-b82e-16c9956f2233 -
New CVE Received by [email protected]
Jun. 03, 2026
Action Type Old Value New Value Added Description A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream `api_base`. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without `basic-auth`. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0. Added CVSS V3 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Added CWE CWE-201 Added Reference https://github.com/mlflow/mlflow/commit/4a3f2f720cb4f058c9e0c5b883e0acc9ab64a7f3 Added Reference https://huntr.com/bounties/f8e591a0-0f19-4910-b82e-16c9956f2233
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.