MLflow: MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability
MLflow
More for MLflow RSS feed for MLflow
- Severity
- High, CVSS 7.1
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Record
- CVE-2026-2393
- Affects
- MLflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 11, 2026
- Source last modified
- June 17, 2026
Description
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The _create_webhook() function in mlflow/server/handlers.py accepts a user-controlled url parameter without validation, and the _send_webhook_request() function in mlflow/webhooks/delivery.py sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the MLflow backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers. The lack of input sanitization, URL scheme filtering, or allowlist validation on the webhook URL enables exploitation, potentially leading to cloud credential theft, internal network access, and data exfiltration.
Description quoted from the NVD record.
Who is affected
MLflow, made by LF Projects, is a platform that teams use to manage machine learning work, such as tracking experiments and keeping trained models. This flaw affects MLflow versions before 3.9.0. It is in the webhook feature, which lets MLflow send automatic notifications to a web address. Someone who can log in to your MLflow server could point a webhook at any address. That makes the server send web requests to your internal systems, your cloud provider's built-in information service, or outside servers. This could lead to stolen cloud login credentials, access to your internal network, and data being sent out. This flaw is rated High.
What to do
- If someone in your organization installed or runs MLflow, that person should check which version your MLflow server is running.
- If the version is earlier than
3.9.0, update MLflow to version3.9.0or later, which is the first version without this flaw. - If an IT provider or vendor runs MLflow for your organization, send them this advisory and ask when the update will be done.
- For full details on the fix, read the vendor advisory linked on this page.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.