CVE-2026-92568 in MLRun
Resumen
por MITRE • 2026-09-17
MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Attackers can update a run with a malicious webhook notification that executes when the run reaches a terminal state, enabling requests to internal services, Kubernetes APIs, or cloud metadata endpoints from within the cluster.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.