Executive brief
MLflow is an open-source platform used by data scientists to manage the machine learning lifecycle. A security vulnerability in its webhook feature allows an authorized user to trick the server into making unauthorized requests to internal systems. This could allow an attacker to steal sensitive cloud credentials, access private internal services, or exfiltrate data from the corporate network.
Technical details
A Server-Side Request Forgery (SSRF) exists in MLflow's webhook implementation. The `_create_webhook()` function in `mlflow/server/handlers.py` fails to validate the user-provided `url` parameter. Subsequently, the `_send_webhook_request()` function in `mlflow/webhooks/delivery.py` executes HTTP POST requests to this unvalidated URL. An authenticated attacker can exploit this to target internal services, loopback addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The vulnerability is addressed in version 3.9.0 by implementing URL scheme filtering (enforcing HTTPS) and IP address validation to block private and reserved ranges.
Affected products
- LF Projects MLflow < 3.9.0
Timeline
- 2026-02-13: patched: Fix committed to GitHub repository
- 2026-05-11: disclosed: Vulnerability disclosed via huntr.dev
- 2026-05-11: advisory: NVD published the CVE record