{"id":"ghsa-ghsa-2wqp-q3c6-ccj5","seq":661294,"kind":"advisory","title":"MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints","url":"https://github.com/advisories/GHSA-2wqp-q3c6-ccj5","permalink":"https://vulnpulse.app/items/ghsa-ghsa-2wqp-q3c6-ccj5","summary":"影響: pip:mlflow >= 3.12.0rc0, < 3.17.0 → 3.17.0\nMLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke with no authentication, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional trulens + trulens-providers-litellm packages installed, an unauthenticated attacker can force the server to make an outbound HTTP request to an arbitrary host of their choosing, carrying attacker-controlled headers (SSRF). Details Scorer.model_validat…","severity":"medium","techs":["python"],"cves":["CVE-2026-115886"],"tags":["GHSA-2wqp-q3c6-ccj5","mlflow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:07:26.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}