Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-17T22:17:23.580Z",
  "pubdate": "2026-08-17T22:17:23.580Z",
  "executiveSummary": "An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the MLflow open source AI engineering platform prior to version 3.15.0.\nThe vulnerability allows remote attackers to interact with internal networks and cloud metadata services via the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint.\nBy manipulating the webhook URL to trigger HTTP redirects, an attacker can bypass initial URL validation checks and force the server to resolve and query arbitrary internal or sensitive endpoints.\nSuccessful exploitation results in the exposure of internal service responses, including response_status and response_body, directly back to the unauthenticated attacker.\nThis introduces significant risk to cloud-hosted deployments, potentially exposing internal metadata endpoints, credentials, and confidential internal services accessible from the MLflow server network context.",
  "technicalDetails": "The vulnerability resides in the webhook testing and delivery mechanism of MLflow, specifically involving the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint, which invokes validation logic in mlflow/utils/validation.py and subsequent delivery logic in mlflow/webhooks/delivery.py.\nThe root cause of the vulnerability is a validation bypass via follow-up HTTP redirects. When a webhook test is initiated, the application calls _validate_webhook_url() to inspect the user-supplied URL. However, this validation is performed solely against the original URL string prior to resolution and dispatch.\nDuring actual request delivery executed within mlflow/webhooks/delivery.py, the underlying HTTP client follows redirects and re-resolves target hostnames without pinning or re-validating the resolved IP address against the initial security policy.\nAn attacker can exploit this flaw by supplying a benign or publicly accessible initial URL that passes the initial _validate_webhook_url() check. This initial URL immediately issues a redirect pointing to an internal resource, such as a cloud provider metadata service (e.g., 169.254.169.254) or an internal microservice.\nWhen the MLflow server follows the HTTP redirect, it resolves the new hostname or IP address, connects to the internal destination, executes the request, and captures the application-level response.\nBecause the test webhook endpoint returns the execution results containing both the response_status and response_body, the attacker successfully retrieves the sensitive data from the internal or cloud metadata service.\nThe vulnerability requires no authentication or special privileges and is exposed over the network via the standard API interface of the MLflow platform.\nAffected systems include all versions of MLflow prior to 3.15.0."
}