CVE-2026-115886mediumCode execution2026-10-23
CVE-2026-115886: MLflow scorer endpoints allow unauthenticated SSRF
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
What it is
MLflow 3.12.0rc0 up to (not including) 3.17.0 exposes the scorer invoke, register and GenAI evaluate endpoints, including the unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke.
The handler rebuilds a third-party scorer from attacker-supplied JSON. Its module allowlist does not limit which class is picked or what constructor arguments it gets, so with the optional trulens and trulens-providers-litellm packages installed, an attacker can make the server send HTTP requests to any host with attacker-chosen headers (server-side request forgery).
How to check
- Compare your installed version with the range above (command below).
How to fix
- Upgrade mlflow to 3.17.0 or later.
- Do not expose an MLflow tracking server to the internet without authentication in front of it.