MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Lfprojects Mlflow
cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*
|
— |
3.15.0
|
References 6
https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939
security-advisories@github.com
https://github.com/mlflow/mlflow/issues/24179
security-advisories@github.com
https://github.com/mlflow/mlflow/pull/24258
security-advisories@github.com
https://github.com/mlflow/mlflow/releases/tag/v3.15.0
security-advisories@github.com
https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
security-advisories@github.com
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026…
134c704f-9b21-4f2e-91b3-4a467353bcc0