CVE-2026-3198

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Published

Jun 2, 2026, 2:50:47 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.24% · Oct 25, 2026

A flaw was found in MLflow. When configured with basic authentication, MLflow fails to enforce proper authorization checks for several Gateway API list endpoints. This oversight allows any authenticated user, regardless of their assigned permissions, to enumerate sensitive information such as gateway secrets, endpoint configurations, and proprietary model definitions. This vulnerability leads to unauthorized information disclosure, potentially exposing critical system details and API keys. mlflow: MLflow: Information disclosure via insufficient authorization checks in Gateway API endpoints This Moderate impact flaw affects MLflow deployments configured with basic authentication in Red Hat OpenShift AI. An authenticated user, regardless of their specific permissions, can enumerate sensitive Gateway API information, including secrets, endpoint configurations, and proprietary model definitions, leading to unauthorized information disclosure. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.