PT-2026-39649 · Mlflow · Mlflow

Tomu Hirata · Published 2026-05-11 · Updated 2026-05-28 · CVE-2026-2393

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.9.0

Description A Server-Side Request Forgery (SSRF) issue exists where the create webhook() function in mlflow/server/handlers.py accepts a user-controlled url parameter without validation. Subsequently, the send webhook request() function in mlflow/webhooks/delivery.py sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers. The lack of input sanitization, URL scheme filtering, or allowlist validation enables potential cloud credential theft, internal network access, and data exfiltration.

Recommendations Update to version 3.9.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-MLFLOW-2026-2393

CVE-2026-2393

GHSA-65H7-C7C4-MGHX

Affected Products

Mlflow

References · 8

• 🔥 https://huntr.com/bounties/04ef100d-06b5-4a70-95b1-b7be23aa8150 · Exploit
• https://github.com/mlflow/mlflow/commit/64aa0ab7207f9c649b59ba1a5f40d82196817389 · Patch
• https://osv.dev/vulnerability/BIT-mlflow-2026-2393 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2393 · Security Note
• https://osv.dev/vulnerability/GHSA-65h7-c7c4-mghx · Vendor Advisory
• https://github.com/mlflow/mlflow · Note
• https://twitter.com/CVEnew/status/2053932450829725705 · Twitter Post
• https://twitter.com/0x2ed3bb60/status/2053903209106940093 · Twitter Post