EUVD-2026-60473
GHSA-7gwp-5pfp-969j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Unauthenticated network endpoint (PR:N, AV:N); redirect-based bypass keeps AC:L; SSRF crosses a boundary (S:C); metadata response_body leak is C:H, limited internal POST is I:L, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
5Blast Radius
ecosystem impact- 1 pypi packages depend on mlflow (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.15.0.
DescriptionCVE.org
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
AnalysisAI
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making outbound requests to internal or cloud metadata endpoints via the POST /api/2.0/mlflow/webhooks/{id}/test endpoint. Because URL validation and the actual delivery re-resolve the hostname independently and follow redirects, an attacker can bypass the public-IP check and receive the target's response_status and response_body, enabling exfiltration of cloud credentials (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the MLflow webhooks feature and network reachability to the POST /api/2.0/mlflow/webhooks/{id}/test endpoint, which is unauthenticated (PR:N) - so no credentials are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward genuine priority for exposed instances. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an internet-exposed MLflow server sends POST /api/2.0/mlflow/webhooks/{id}/test pointing at an attacker-controlled host that passes the public-IP check, then HTTP-redirects (or DNS-rebinds) the delivery request to http://169.254.169.254/latest/meta-data/iam/security-credentials/. MLflow follows the redirect, re-resolves the target, and returns the metadata service's response_body to the attacker, exposing cloud IAM credentials. … |
| Remediation | Vendor-released patch: upgrade to MLflow 3.15.0, which adds the SSRFProtectedHTTPAdapter that pins validation to the actual connected peer IP (see GHSA-7gwp-5pfp-969j and release https://github.com/mlflow/mlflow/releases/tag/v3.15.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all MLflow deployments and versions; assess whether the POST /api/2.0/mlflow/webhooks/{id}/test endpoint is exposed to untrusted networks; isolate internet-facing instances if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. Rated critical severity (CVSS 9.6), t
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of specia
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today