Server-Side Request Forgery in MLflow AI Gateway (CVE‑2026‑71211) Exposes Internal Resources
What It Is — A Server‑Side Request Forgery (SSRF) flaw exists in the MLflow AI Gateway component. The vulnerability stems from insufficient validation of the api_base URI field, allowing an authenticated remote attacker to force the service to issue arbitrary HTTP requests on behalf of its service account. Exploitation can reach internal services, cloud metadata endpoints, or any reachable network resource, potentially leading to information disclosure or lateral movement. The issue is assigned CVE‑2026‑71211, carries a CVSS 7.7 (High) score, and was publicly disclosed on 29 Oct 2026. A fix is available in MLflow 3.17.0.
Affected Products — MLflow (AI Gateway) – all versions prior to 3.17.0.
Why It Matters for Trust & Control Assurance — The flaw highlights the need for robust input‑validation and network‑segmentation controls, a core control objective that maps to many frameworks (e.g., NIST CSF Protect). Verisq’s Control Mapping capability helps you evidence that such validation controls are in place and continuously monitored.
Recommended Actions
- Upgrade MLflow to 3.17.0 or later.
- Review and harden validation of any user‑supplied URIs (e.g.,
api_base). - Implement outbound‑request monitoring for the MLflow service account.
- Document the remediation in your control evidence repository.
Source: Zero Day Initiative advisory