CVE-2026-4035: Environment Variable Resolution Vulnerability in mlflow/mlflow

Synopsis

An environment variable resolution vulnerability in mlflow/mlflow (versions prior to 3.11.0) allows attackers to inject `$ENV_VAR` references into AI Gateway secret configurations, causing the MLflow server to resolve and forward sensitive server-side environment variables to an attacker-controlled endpoint. The vulnerability is reachable over the network and requires only a low-privileged account in basic-auth deployments, or no account at all in default deployments. Successful exploitation leaks credentials such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, enabling artifact poisoning and cross-boundary code execution in downstream environments. A patched-image rebuild at version 3.11.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The MLflow AI Gateway must be reachable over the network; an attacker sends a crafted secret configuration referencing server-side environment variables via the exposed HTTP API.

• AuthenticationRequired

  In basic-auth deployments any low-privilege account is sufficient to exploit this vulnerability; in default deployments without basic-auth, no authentication is required at all.

• Victim interactionNot required

  No victim action is needed; the server resolves environment variables and forwards credentials automatically during normal request processing.

• Attack complexityDetail

  Exploitation is reliable and condition-free: injecting a $ENV_VAR reference into the api_key field and pointing api_base at an attacker-controlled endpoint is the entire attack chain, with no race conditions or special environmental factors required.

Blast Radius

• Reads server-side environment variables including cloud credential pairs such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY by receiving them in forwarded authentication headers.
• Gains access to cloud storage artifacts protected by the exfiltrated credentials, enabling reads of proprietary model weights, training data, and pipeline outputs.
• Overwrites or poisons stored artifacts in cloud buckets using the stolen credentials, injecting malicious model files or dependencies consumed by downstream build and inference pipelines.
• Achieves cross-boundary code execution in downstream environments that automatically load or execute artifacts pulled from the compromised storage location.