5 matches found
CVE-2025-9909: Use of Non-Canonical URL Paths for Authorization Decisions
A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash // prefix in the gatewaypath. A malicious or socially engineered administrator can configure a...
Server Side Request Forgery (SSRF)
mlflow is vulnerable to missing input validation. The vulnerability is due to missing validation of the gatewaypath parameter in the gatewayproxyhandler function, allowing an attacker to manipulate the request path to access unintended internal endpoints or services...
PYSEC-2025-52
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
