MLflow SSRF vulnerability on unauthenticated scorer endpoints

MLflow's tracking server exposes unauthenticated endpoints that allow attackers to instantiate arbitrary classes with unconstrained kwargs, enabling SSRF attacks when optional trulens packages are installed.

Disclosed 23 October 2026 · Record updated 23 October 2026

Impact

Unauthenticated attackers can force MLflow servers to make arbitrary outbound HTTP requests with attacker-controlled headers when trulens and trulens-providers-litellm packages are installed.

Our coverage

A mechanical hand reaches into an open vault, pulling out unmarked packages while security cameras hang dark and powerless on the walls.

Vulnerabilities

Unauthenticated MLflow servers can be forced to call attacker hosts

A GitHub advisory published on 23 October 2026 says MLflow's scorer endpoints accept unconstrained class names and keyword arguments from anonymous callers.

23 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-2wqp-q3c6-ccj5