CVE-2026-3198

Katalog CVE

CVSS 6.5 · Medium EPSS 0,36%

Kerentanan Improper Access Control pada lfprojects mlflow. Skor CVSS 3.0 6.5 (Medium) menurut huntr.dev.

Deskripsi (NVD)

MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.

Rincian

Terbit di NVD

2 Juni 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.0

6.5 (Medium), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/e57db731-97d3-40c3-a429-831ee959807f exploit · advisory pihak ketiga