CVE-2026-4035

[CVE catalog]

Severity

High · CVSS 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Published

Jun 3, 2026, 7:18:08 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.52% · Oct 25, 2026

A flaw was found in MLflow. This vulnerability allows an attacker to exfiltrate sensitive server-side environment credentials. It occurs because the AI Gateway secrets can resolve environment variables, which are then sent to an attacker-controlled endpoint. This could lead to unauthorized access to cloud resources and potentially enable cross-boundary code execution. python-mlflow: MLflow: Sensitive credential exfiltration via environment variable resolution in AI Gateway secrets This is a flaw in MLflow Server’s AI Gateway: if a gateway secret’s api_key uses a $ENV_VAR form, the server resolves it from pod environment variables and can send those values to a configured upstream api_base. The primary impact is credential disclosure (CWE-201), not direct remote code execution on the platform. For OpenShift AI, most affected Konflux images embed the mlflow package (notebooks, pipelines, training runtimes) but do not run MLflow Server + AI Gateway in their default role. The clearest product exposure is odh-mlflow-rhel9, where the server component is actually shipped and operated. Exploitation requires Gateway configuration reachability and, in typical deployments, authenticated access (PR:L); unauthenticated abuse applies only where MLflow is deployed without basic-auth. Downstream artifact abuse depends on secondary use of leaked credentials, not a standalone RCE primitive in OpenShift AI itself. Hence, the impact is set to Important. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.