Executive brief
MLRun is an open-source MLOps platform that orchestrates machine learning workflows. A vulnerability in its webhook notification system allows authenticated users to configure malicious webhooks that force the MLRun API server to make arbitrary HTTP requests to internal services, including Kubernetes APIs and cloud metadata endpoints, potentially exposing sensitive information or enabling lateral movement within the cluster.
Technical details
The WebhookNotification handler in MLRun through version 1.11.0 fails to properly validate webhook URLs, allowing authenticated users to inject arbitrary destinations. When a run reaches a terminal state, the API server automatically sends notifications to the configured webhook URL without restriction on destination. An attacker with authentication can update a run object to include a malicious webhook pointing to internal services (e.g., http://localhost:port, Kubernetes API endpoints, or cloud metadata endpoints), causing the API server itself to make the request from within the cluster's trust boundary. This SSRF vulnerability requires authentication and is exploitable once a run reaches a terminal state. No patch status is indicated in the advisory.
Affected products
- MLRun MLRun through 1.11.0
Timeline
- 2026-09-16: disclosed