MLflow
CVE-2026-118628
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed MLflow endpoint
-
ExploitSend get-artifacts request with malicious URI
-
ExecutionServer fetches unvalidated resource (SSRF)
-
ImpactSensitive data returned to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the MLflow server's get-artifacts function, which accesses resources from a supplied URI without proper validation (CWE-918 SSRF). Per the CVSS vector (PR:N/UI:N), it is unauthenticated and requires no user interaction; the realistic prerequisite is that the MLflow artifact/tracking server endpoint is network-reachable by the attacker. The practical limiting factor is reachability and what internal resources the server itself can access - the disclosed data is bounded by the server's own network/file context (I:L, A:N indicate limited integrity and no availability impact). No specific non-default configuration is called out in the available sources as required. |
| Impact | This is a credible, near-term priority rather than an inflated high-CVSS score. The CVSS:3.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable flaw requiring no authentication, no user interaction, and low complexity, with high confidentiality impact (C:H) and limited integrity impact (I:L) - consistent with a classic SSRF (CWE-918) that reads back resources the server can reach. The vuln.today decision label is 'this_week', signaling prompt but not emergency action. No EPSS probability, CISA KEV listing, or SSVC automatable/technical-impact values were provided in the input, so probabilistic and automation signals cannot be weighed - their absence is not evidence of low risk, only missing telemetry. No public exploit identified at time of analysis: the sole reference is the Zero Day Initiative advisory (ZDI-26-844), which is a vulnerability advisory, not published working exploit code. The main point of agreement across available signals is that unauthenticated network reachability plus high confidentiality impact makes this attractive; the main gap is the lack of EPSS/KEV data to judge whether exploitation is actually occurring in the wild. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to the MLflow server's get-artifacts function supplying an attacker-controlled URI. Because the URI is not properly validated before resources are accessed, the server fetches and returns data from internal/unintended locations, disclosing sensitive information in the server's context (e.g., internal services or files reachable by the server). No public exploit code is identified; the only reference is the ZDI advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
Server-side request forgery in MLflow's get-artifacts function lets unauthenticated remote attackers induce the server to access attacker-supplied URIs and disclose sensitive information from the server's context; the CVSS 3.x base score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). The flaw is tracked as CWE-918 and ZDI-CAN-28192/ZDI-26-844, with a vuln.today decision label of this_week. No CISA KEV confirmation was provided, and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch or fixed version is identified in the supplied data; no exact upgrade target can be stated from the available intelligence. Consult ZDI-26-844 (https://www.zerodayinitiative.com/advisories/ZDI-26-844/) for the vendor's remediation guidance. Pending a fix, reduce SSRF exposure by restricting outbound network access from the MLflow server to only required artifact stores and internal services, with an allowlist that blocks private, link-local, loopback and cloud-metadata address ranges - trade-off: legitimate artifact repositories on internal ranges may need explicit exceptions and egress filtering can break remote artifact workflows. If the get-artifacts endpoint is not needed, disable or restrict it at the reverse proxy/API gateway, and require authentication/network segmentation for the MLflow tracking server - trade-off: clients and integrations that rely on the endpoint or direct server access will fail until reconfigured. These are compensating controls, not a substitute for a vendor patch.
Affected ProductsAI
Affected products are MLflow installations that expose the get-artifacts function, as reported in ZDI-26-844 (ZDI-CAN-28192). The supplied data does not include CPE strings or an exact version range, so the precise affected releases are not confirmed here; administrators should treat internet- or broadly network-reachable MLflow tracking/artifact servers as in scope and consult the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-844/ for the vendor's affected-version statement.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MLflow is a machine-learning lifecycle platform whose tracking/artifact server exposes endpoints that retrieve artifacts; the get-artifacts function is the specific component named in ZDI-26-844. CWE-918 describes the root cause: the server accepts a URI and accesses the referenced resource before adequately validating the destination, so an attacker can make server-side requests that the attacker cannot make directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms a network-reachable, unauthenticated, no-interaction path with high confidentiality impact, limited integrity impact and no availability impact; the disclosed data is bounded by the MLflow server's own network and file context. No CPE strings were supplied, so exact affected builds are not confirmed from CPE data; the trigger details beyond the URI-validation failure are not described in the available sources.
Know when Mlflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Unauthenticated network SSRF with no UI (AV:N/AC:L/PR:N/UI:N); high confidentiality disclosure with limited integrity effect and no availability impact, matching the described information-disclosure behavior.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the get-artifacts function. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the server. Was ZDI-CAN-28192.
Executive ViewAI
MLflow's get-artifacts endpoint contains a server-side request forgery flaw that lets unauthenticated outsiders direct the server to fetch attacker-chosen URIs and expose sensitive server-side data. Because no authentication is required and no patch exists, any internet-reachable MLflow deployment is exposed to information disclosure and data exfiltration. Leadership should treat any MLflow instance used for model tracking or artifact storage as a priority containment item.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict MLflow network exposure, enforce outbound egress allowlisting, segment the service, and monitor get-artifacts calls for suspicious URIs.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking serv
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
GitHub PoC
Exploit-DB