MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation …

CVE-2026-71211 describes a Server-Side Request Forgery (SSRF) vulnerability in MLflow's AI Gateway feature. The _create_gateway_secret function in mlflow/server/handlers.py accepts an auth_config.api_base value with no validation of scheme, host, or IP range, storing it verbatim. The raw_proxy endpoint in mlflow/server/gateway_api.py then issues HTTP requests to that stored api_base combined with caller-supplied paths, returning full response bodies. MLflow's existing SSRF guard (_validate_webhook_url) is never invoked in this code path. Compounding the issue, the CreateGatewaySecret action lacks an entry in the permission-validator map, requiring only basic authentication, meaning any authenticated user including read-only accounts can exploit the flaw. This allows attackers to target internal addresses and potentially exfiltrate cloud IAM credentials via metadata services (e.g., 169.254.169.254). The vulnerability is related to but independent from CVE-2026-4035, which addressed a separate credential leakage mechanism in the same feature via server-side environment variable resolution in the api_key field.