Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · MLflow

CVE-2026-2393: MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability

highCVSS 3.0 7.1GHSA-65h7-c7c4-mghx

A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The createwebhook() function in mlflow/server/handlers.py accepts a user-controlled url parameter without validation, and the sendwebhookrequest() function in mlflow/webhooks/delivery.py sends HTTP POST requests to this attacker-controlled URL.

Published May 11, 2026 · Updated May 18, 2026

Affected packages

mlflow

Ecosystem
PyPI
Affected
< 3.9.0
Fixed in
3.9.0
Check
pip show mlflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The _create_webhook() function in mlflow/server/handlers.py accepts a user-controlled url parameter without validation, and the _send_webhook_request() function in mlflow/webhooks/delivery.py sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the MLflow backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers. The lack of input sanitization, URL scheme filtering, or allowlist validation on the webhook URL enables exploitation, potentially leading to cloud credential theft, internal network access, and data exfiltration.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MLflow vulnerabilities

All MLflow entries