An advisory published on 29 October 2026 has described a server-side request forgery flaw in MLflow's AI Gateway, tracked as CVE-2026-71211 and ZDI-26-847. The flaw is rated at CVSS 7.7 in the advisory summary, and it requires authentication to exploit. It matters because AI platforms often sit close to cloud services and internal systems.

MLflow is widely used to track experiments and manage machine-learning work. Its AI Gateway lets users route requests to configured model providers. The problem described in the advisory is not in the model itself, but in how the gateway handles a configured endpoint address, and in what happens when that address is combined with a path supplied by the caller.

What the flaw allows

According to the advisory summary, when a gateway secret is created, the endpoint address supplied (api_base) was stored without validation of scheme, host or address range. The gateway's raw proxy route then sent a request to that address plus a caller-supplied path and returned the full response. An existing SSRF guard used elsewhere in MLflow was not called in this code path, and creating a gateway secret required only basic authentication. An authenticated user could therefore point the gateway at an internal address, with cloud metadata services named as a particular risk.

What teams should do

The fix described in the advisory introduces two-stage validation and blocks private addresses by default. Administrators in multi-user settings should confirm the patched code is deployed and review gateway secrets pointing at internal hosts. Deployments that deliberately use local services will need an explicit override to keep working, and that override should be treated as a conscious exception rather than a default. Authentication alone is not a sufficient control here, because the flaw is reachable by an authenticated user.

Sources: DeafNews summary of ZDI-26-847; VulDB record for CVE-2026-71211.