MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) (mlflow mlflow)
At a glance
- Source
- NVD
- EPSS
- EPSS 10.02 % · percentile 96 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
Weaknesses (CWE)
- CWE-918 — Server-Side Request Forgery
References
- https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
- https://github.com/mlflow/mlflow/issues/24179
- https://github.com/mlflow/mlflow/pull/24258
- https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939
- https://github.com/mlflow/mlflow/releases/tag/v3.15.0
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N | GitHub_M |
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-7gwp-5pfp-969j — MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
- PYSEC-2026-3687 — MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
European references
- ENISA EUVD · EUVD-2026-60473
- GCVE · GCVE-0-2026-64849
Affected configurations (NVD CPE)
cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*≥ 3.3.0 < 3.15.0
Affected products
| Product | Versions |
|---|---|
| mlflow · mlflow | affected >= 3.3.0, < 3.15.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |