MLflow - CraftedSignal Threat Feed

Multiple Vulnerabilities in MLflow Enabling Arbitrary Code Execution

hello@craftedsignal.io — Thu, 24 Sep 2026 13:58:02 +0000

The MLflow platform, managed by the LF AI & Data Foundation, is susceptible to multiple vulnerabilities that allow for remote code execution (RCE). These vulnerabilities, tracked under CVE-2023-6976, CVE-2023-6977, and CVE-2023-6978, arise from weaknesses in input validation and insecure deserialization processes within the software. These flaws enable an unauthenticated or low-privileged attacker to inject malicious payloads into the MLflow environment, leading to full system compromise. Given MLflow's common role in machine learning pipelines, a successful exploit could grant an attacker access to sensitive model data, training parameters, and the underlying infrastructure running the MLflow server or tracking components. Defenders should prioritize patching and assess exposure of MLflow instances to untrusted networks.

Impact

Successful exploitation of these vulnerabilities allows an attacker to achieve arbitrary code execution on the server hosting MLflow. This level of access facilitates full environment compromise, potentially resulting in data exfiltration, tampering with machine learning model artifacts, and lateral movement within the network. These vulnerabilities represent a high risk for organizations leveraging MLflow for MLOps, particularly in cloud-native or research environments where the platform may be exposed to broader network segments.

Recommendation

Prioritize patching all MLflow installations to the latest version where these CVEs are addressed. As immediate mitigation, ensure that MLflow tracking servers are restricted to trusted internal networks and utilize robust authentication mechanisms. Review server logs for suspicious API requests or unexpected process execution patterns originating from the MLflow service account.

Security Control Bypass in MLflow

hello@craftedsignal.io — Thu, 20 Aug 2026 13:10:26 +0000

The BSI has published a security advisory regarding a vulnerability in MLflow, an open-source platform for the machine learning lifecycle. The flaw allows a remote, unauthenticated attacker to bypass established security controls. By exploiting this vulnerability, an attacker can access sensitive data, disclose internal configuration or experiment metrics, and manipulate stored data within the MLflow instance. Because MLflow is frequently deployed in cloud-native environments to manage experiment tracking and model registry, this vulnerability poses a significant risk to the integrity and confidentiality of machine learning pipelines. Defenders should prioritize auditing access controls for MLflow instances and ensure that they are not exposed to the public internet without robust authentication mechanisms.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive machine learning assets, including model artifacts and training experiment metadata. This could facilitate the theft of proprietary models or the poisoning of training data. While the specific number of affected entities is not publicly disclosed, the widespread use of MLflow in data science and engineering sectors suggests a broad attack surface for organizations utilizing the platform in their production or R&D environments.

Recommendation

Audit MLflow deployment configurations to ensure that authentication and authorization features are strictly enforced.
Restrict access to the MLflow web interface and API endpoints to trusted internal networks or via VPNs.
Review access logs for anomalous behavior, such as unauthorized attempts to access /api/2.0/mlflow/ or registry-related endpoints.
Monitor for unauthorized modification of experiment metadata or model artifacts.
Apply the latest security updates provided by the MLflow development team to address CVE-2023-6683.

MLflow Tracking Server Unauthenticated Full-Read SSRF via Webhook Delivery

hello@craftedsignal.io — Tue, 18 Aug 2026 00:46:13 +0000

MLflow Tracking Server (v3.13.0 and earlier) contains an SSRF vulnerability (CVE-2026-64849) in its webhook delivery mechanism. While the application implements a validation function (_validate_webhook_url) intended to restrict connections to public IP addresses, the implementation fails to pin the resolved IP address, and the HTTP client follows redirects without re-validating the final destination. An unauthenticated attacker can create a webhook pointing to a controlled HTTPS endpoint that issues a 302 redirect to internal network resources, such as the AWS Instance Metadata Service (169.254.169.254) or loopback addresses. Because the synchronous /api/2.0/mlflow/webhooks/{id}/test endpoint reflects the response status and body back to the caller, this allows for unauthenticated full-read exfiltration of sensitive internal data or blind POST interactions with management interfaces on the local network.

Attack Chain

Attacker identifies an internet-facing MLflow Tracking Server instance running with a default configuration (e.g., SQLite backend) lacking authentication plugins.
Attacker prepares a malicious HTTPS-enabled server that returns a 302 HTTP redirect to an internal target (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/).
Attacker submits a POST request to /api/2.0/mlflow/webhooks with the url parameter pointing to the malicious attacker-controlled HTTPS endpoint.
MLflow validates the initial URL; since the attacker's endpoint is a valid public HTTPS URL, the _validate_webhook_url check passes.
Attacker triggers the SSRF by sending a request to the /api/2.0/mlflow/webhooks/{id}/test endpoint.
The MLflow server executes the webhook, follows the 302 redirect to the internal target without re-validation, and fetches the sensitive internal resource.
The server receives the internal response (e.g., cloud credentials) and reflects the full response body back to the attacker in the HTTP response of the /test request.

Impact

Successful exploitation allows unauthenticated attackers to exfiltrate sensitive cloud metadata (e.g., IAM role credentials), query internal-only services, or perform host scanning from the perspective of the MLflow server. Furthermore, by using 307 or 308 redirects, attackers can perform blind POST operations against internal management interfaces like Docker daemons or Spring Boot Actuator endpoints, potentially leading to remote code execution or service disruption within the internal network.

Recommendation

Prioritize the following actions to secure your MLflow environment:

Upgrade MLflow to version 3.15.0 or later immediately to patch CVE-2026-64849.
Enable MLflow authentication plugins to ensure that the webhook API is not accessible to unauthenticated users.
Implement network segmentation to isolate MLflow servers from sensitive cloud metadata endpoints (IMDSv1) and internal management interfaces.
Deploy the suggested webserver-level rules to detect potential SSRF attempts directed at common internal paths.