CVE-2026-71211 is an SSRF in MLflow's gateway secret feature where the api_base parameter accepts arbitrary URLs with no validation, allowing authenticated users to trigger outbound requests from the MLflow server's network position. This is not a case of missing security tooling—it is a case where existing security tooling was architecturally walled off from a new code path.
MLflow contains a validation function, _validate_webhook_url, designed to block requests to non-global IPs and metadata endpoints. That function exists and works. It simply wasn't integrated into the gateway secret proxy flow. CreateGatewaySecret requires only basic authentication with no scope verification, meaning even read-only accounts can invoke it. The combination is severe: any user who can authenticate to MLflow can force the server to make arbitrary HTTP requests to internal services.
The primary attack target is cloud metadata endpoints (169.254.169.254), where IAM credentials for the MLflow deployment's service account can be exfiltrated. But the attack surface extends further. MLflow typically sits inside trusted network segments, with access to model registries, feature stores, experiment databases, and cloud storage. When you achieve SSRF from MLflow's position, you inherit the trust boundaries that network architecture assigned to MLflow's subnet. You may not need to chain through intermediate services—MLflow's own IAM role likely already has the access you want.
Two immediate actions: First, audit your MLflow deployment for any gateway secret configurations and validate that api_base values are restricted to expected endpoints. Second, review CreateGatewaySecret permissions—if any authenticated user can invoke it, elevate the required scope. This is not a hypothetical risk; the metadata service vector has been exploited in similar patterns since AWS hardened IMDSv1 in 2018.
The deeper concern is architectural. The independence of this finding from CVE-2026-4035 (which patched a separate credential-leakage vector in the same feature) indicates that each fix has been treated as a one-off rather than evidence of systemic design failure. If you applied the CVE-2026-4035 patch, you have closed that specific vector—but the gateway secret attack surface remains unmapped. Treat any second independent finding in the same feature as prima facie evidence that the feature needs a feature-wide security audit, not another point patch.