MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability
High7.1CVE-2026-2393 · Published May 11, 2026 · updated Jul 13, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 3.9.0 | 3.9.0 |
Details and references
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter without validation, and the `_send_webhook_request()` function in `mlflow/webhooks/delivery.py` sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the MLflow backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers. The lack of input sanitization, URL scheme filtering, or allowlist validation on the webhook URL enables exploitation, potentially leading to cloud credential theft, internal network access, and data exfiltration.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-918
- Also known as
- BIT-mlflow-2026-2393, CVE-2026-2393, PYSEC-2026-2219
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 11 | MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem CVE-2026-2614High7.5fixed in 3.10.0 | High7.5 | 3.10.0 |
| May 15 | MLflow: unauthenticated access to certain FastAPI routes CVE-2026-2652High8.6fixed in 3.11.0 | High8.6 | 3.11.0 |
| May 18 | MLFlow Creates a Temporary File With Insecure Permissions CVE-2026-4137High7.0fixed in 3.11.0 | High7.0 | 3.11.0 |
| May 19 | MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution CVE-2026-2611Critical9.6fixed in 3.10.0 | Critical9.6 | 3.10.0 |
| May 21 | MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks CVE-2026-2734Medium6.5fixed in 3.10.0 | Medium6.5 | 3.10.0 |
| May 26 | MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled CVE-2026-2651Critical9.0fixed in 3.11.0rc1 | Critical9.0 | 3.11.0rc1 |