CVE-2026-115886

Name of the Vulnerable Software and Affected Versions MLflow versions 3.12.0rc0 through 3.16.x

Description An unauthenticated attacker can force the tracking server to make an outbound HTTP request to an arbitrary host, including internal services or cloud-metadata endpoints, with attacker-controlled headers and body. This Server-Side Request Forgery (SSRF) occurs because the server reflectively instantiates a class from attacker-supplied JSON without constraining the selected class or its constructor arguments. Specifically, the Scorer.model validate json() function resolves a module-path allowlist but fails to restrict the reflected attribute or its keyword arguments. When the optional trulens and trulens-providers-litellm packages are installed, an attacker can use the mlflow.genai.scorers.trulens module and a model URI outside the native provider registry to trigger a LiteLLM fallback. This allows the injection of api base and api key values that direct the server to send requests to an external or internal host. The issue affects the POST /ajax-api/3.0/mlflow/scorer/invoke endpoint.

Recommendations Update MLflow to version 3.17.0. As a temporary mitigation, restrict access to the POST /ajax-api/3.0/mlflow/scorer/invoke endpoint or uninstall the trulens and trulens-providers-litellm packages if they are not required.