Skip to content

chore(deps): update dependency mlflow to v3.16.0 [security] - #92

Open
red-hat-konflux-kflux-prd-rh02[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/pypi-mlflow-vulnerability
Open

chore(deps): update dependency mlflow to v3.16.0 [security]#92
red-hat-konflux-kflux-prd-rh02[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/pypi-mlflow-vulnerability

Conversation

@red-hat-konflux-kflux-prd-rh02

@red-hat-konflux-kflux-prd-rh02 red-hat-konflux-kflux-prd-rh02 Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
mlflow 3.15.1 → 3.16.0 age confidence

MLflow AI Gateway permits SSRF through an unvalidated api_base

CVE-2026-71211 / GHSA-h7x2-h6g9-p789 / PYSEC-2026-3865

More information

Details

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. MLflow's existing SSRF guard, _validate_webhook_url (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user — including read-only accounts — can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENV_VAR resolution inside the api_key field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the api_base destination itself, unaffected by that fix.

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

MLflow AI Gateway permits SSRF through an unvalidated api_base

CVE-2026-71211 / GHSA-h7x2-h6g9-p789 / PYSEC-2026-3865

More information

Details

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. MLflow's existing SSRF guard, _validate_webhook_url (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user — including read-only accounts — can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENV_VAR resolution inside the api_key field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the api_base destination itself, unaffected by that fix.

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Release Notes

mlflow/mlflow (mlflow)

v3.16.0

Compare Source

MLflow 3.16.0 includes several major features and improvements

Breaking changes:

Features:

Bug fixes:

Documentation updates:

Small bug fixes and documentation updates:

#​25558, #​25553, #​25392, #​25421, #​25407, #​24828, #​25295, #​25249, #​25055, #​24827, @​joshuawong-db; #​25547, #​25127, #​24884, #​25501, #​24714, #​24913, #​24879, @​B-Step62; #​25544, #​25542, #​25540, #​25538, #​25537, #​25534, #​25531, #​25530, #​25506, #​25466, #​25436, #​25408, #​25405, #​25390, #​25320, #​25256, #​25023, #​25014, #​24993, #​24992, #​24988, #​24986, #​24955, #​24872, #​24855, #​24856, @​copilot-swe-agent; #​25545, #​25502, #​25486, #​25485, #​25482, #​25481, #​25478, #​25475, #​25468, #​25467, #​25464, #​25462, #​25461, #​25465, #​25457, #​25456, #​25452, #​25450, #​25447, #​25446, #​25443, #​25437, #​25430, #​25432, #​25423, #​25429, #​25409, #​25420, #​25417, #​25419, #​25401, #​25404, #​25402, #​25396, #​25393, #​25368, #​25358, #​25346, #​25344, #​25343, #​25342, #​25341, #​25339, #​25338, #​25337, #​25335, #​25334, #​25325, #​25316, #​25312, #​25277, #​25276, #​25252, #​25165, #​25163, #​25162, #​25161, #​25160, #​25159, #​25158, #​25156, #​25154, #​25153, #​25152, #​25144, #​25142, #​25124, #​25122, #​25117, #​25109, #​25110, #​25106, #​25103, #​25100, #​25099, #​25096, #​25090, #​25092, #​25091, #​25088, #​25048, #​25047, #​25042, #​25041, #​25037, #​25030, #​25032, #​25031, #​25029, #​25022, #​24996, #​24991, #​24990, #​24987, #​24982, #​24980, #​24977, #​24978, #​24975, #​24974, #​24973, #​24972, #​24971, #​24970, #​24968, #​24966, #​24965, #​24910, #​24908, #​24922, #​24911, #​24909, #​24901, #​24866, #​24874, #​24853, #​24840, #​24839, #​24834, #​24791, #​24751, #​24770, @​harupy; #​25533, #​25528, #​25305, #​25304, #​25302, #​25296, #​25222, @​kriscon-db; #​25412, #​25309, @​IgorShishkin12; #​25520, #​25519, #​25015, #​24945, #​24943, #​24944, #​24902, #​24904, #​24905, #​24903, @​dependabot; #​25081, #​24880, #​24802, @​mprahl; #​25505, #​25500, #​25480, #​25379, #​25360, #​25351, #​24754, @​TomeHirata; #​25477, #​25459, @​CoralGarden52; #​25180, @​miyakido; #​25369, @​d0w; #​25400, @​ArrayPD; #​25391, #​25329, #​25104, [@​tanghaoji](https:

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux-kflux-prd-rh02
chore(deps): update dependency mlflow to v3.16.0 [security]
5d6b25d 
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants