MLflow up to 3.9.x HTTP POST Request handlers.py _create_webhook url server-side request forgery

Summaryinfo

A vulnerability categorized as critical has been discovered in MLflow up to 3.9.x. The affected element is the function _create_webhook of the file mlflow/server/handlers.py of the component HTTP POST Request Handler. Such manipulation of the argument url leads to server-side request forgery. This vulnerability is referenced as CVE-2026-2393. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in MLflow up to 3.9.x. Affected by this issue is the function _create_webhook of the file mlflow/server/handlers.py of the component HTTP POST Request Handler. The manipulation of the argument url with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter without validation, and the `_send_webhook_request()` function in `mlflow/webhooks/delivery.py` sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the MLflow backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers. The lack of input sanitization, URL scheme filtering, or allowlist validation on the webhook URL enables exploitation, potentially leading to cloud credential theft, internal network access, and data exfiltration.

The advisory is shared for download at huntr.com. This vulnerability is handled as CVE-2026-2393 since 02/12/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

Upgrading to version 3.10.0 eliminates this vulnerability. Applying the patch 64aa0ab7207f9c649b59ba1a5f40d82196817389 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• MLflow

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9

License

• open-source

Website

• Product: https://github.com/mlflow/mlflow/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion