Vulnerability · Published May 11, 2026 · Assigned by @huntr_ai
CVE-2026-2393Server-Side Request Forgery (SSRF) in mlflow/mlflow
High 7.1
In plain English
A high-severity server-side request forgery in mlflow/mlflow from mlflow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter without validation, and the `_send_webhook_request()` function in `mlflow/webhooks/delivery.py` sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the MLflow backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers. The lack of input sanitization, URL scheme filtering, or allowlist validation on the webhook URL enables exploitation, potentially leading to cloud credential theft, internal network access, and data exfiltration.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mlflow | 3.9.0 | GHSA-65h7-c7c4-mghx |
| PyPI | mlflow | 3.9.0 | PYSEC-2026-2219 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mlflow | mlflow/mlflow | unspecified – before 3.10.0 |
Weakness: CWE-918 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N