Unauthenticated SSRF in MLflow get‑artifacts (CVE‑2026‑118628) Exposes Sensitive Data

Unauthenticated SSRF in MLflow get‑artifacts (CVE‑2026‑118628) Exposes Sensitive Data

What It Is — The Zero Day Initiative advisory (ZDI‑26‑844) details a server‑side request forgery (SSRF) flaw in the get‑artifacts endpoint of MLflow. The function fails to validate a supplied URI before the server fetches the resource, allowing a remote, unauthenticated attacker to force the MLflow server to make arbitrary HTTP requests and return the response. The vulnerability results in information disclosure (confidential data in the server’s context) and is rated CVSS 8.2 (High). No authentication or user interaction is required. The issue is fixed in MLflow 3.17.0 (see the upstream pull request).

Affected Products — MLflow (all versions prior to 3.17.0).

Why It Matters for Trust & Control Assurance — This flaw tests the control objective of input validation and secure handling of external resources. Demonstrating that such validation controls are in place and auditable satisfies multiple framework requirements (e.g., NIST CSF, ISO 27001).

Recommended Actions —

• Upgrade all MLflow deployments to version 3.17.0 or later.
• If immediate upgrade is not possible, implement a reverse‑proxy rule or web‑application firewall rule that restricts outbound requests from the get‑artifacts endpoint to trusted hosts only.
• Document the remediation in your control evidence repository and map the fix to the “input validation” control objective.
• Conduct a targeted SSRF test to confirm the issue is fully mitigated.

Source: Zero Day Initiative Advisory – ZDI‑26‑844