Research · Aug 17, 2026
Critical Vulnerability Discovered in MLflow: Server-Side Request Forgery Risk
A significant server-side request forgery vulnerability has been identified in MLflow, affecting versions from 3.3.0 to 3.15.0, which could allow unauthorized access to sensitive internal services.
What changed
A newly discovered server-side request forgery (SSRF) vulnerability in MLflow has raised concerns regarding the security of the platform. This vulnerability exists in versions 3.3.0 through 3.15.0, where the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint is improperly handling URL validation.
- The _validate_webhook_url() function only validates the original URL, failing to secure against redirects.
- Attackers can exploit this flaw to access internal or cloud metadata services.
- The issue has been addressed in version 3.15.0, which mitigates the risk.
Who is affected
The vulnerability impacts a range of users and organizations utilizing MLflow for their AI and machine learning operations. Those running versions 3.3.0 to 3.15.0 are particularly at risk.
- Organizations using MLflow for AI engineering.
- Developers deploying machine learning models with MLflow.
- Companies leveraging cloud services integrated with MLflow.
- Users relying on webhooks for automated workflows in MLflow.
What to do
To safeguard against this vulnerability, it is crucial for users to update their MLflow installations to version 3.15.0 or later. Additionally, organizations should review their security policies regarding webhook configurations.
- Upgrade to MLflow version 3.15.0 or higher immediately.
- Conduct a security audit of existing webhook configurations.
- Implement monitoring to detect any unauthorized access attempts.
- Educate teams about the risks associated with SSRF vulnerabilities.