MLflow - SSRF (CVE-2026-115886)
Description
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission. This issue is fixed in version 3.17.0.
psychologyCrowdSec Analysis
CVE-2026-115886 is a server-side request forgery (SSRF) vulnerability in MLflow versions 3.12.0rc0 through 3.16.x, where unauthenticated scorer endpoints can process crafted serialized data and trigger outbound requests to attacker-controlled or internal hosts. The attack requires the optional TruLens and LiteLLM provider packages to be installed and may expose internal services or enable requests with attacker-controlled headers and content; the issue is fixed in MLflow 3.17.0.
CrowdSec has been tracking this vulnerability and its exploits since 28th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-115886 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Observed exploitation attempts target /ajax-api/3.0/mlflow/scorer/invoke with crafted serialized_scorer data. The attacker supplies an api_base URL to induce the MLflow server to make outbound requests to attacker-controlled or internal hosts.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-10-23 |
| Rule Released | 2026-10-28 |
Related Weaknesses
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Remediation & Protection
External References
- https://github.com/mlflow/mlflow/security/advisories/GHSA-2wqp-q3c6-ccj5
- https://github.com/mlflow/mlflow/pull/25890
- https://github.com/mlflow/mlflow/releases/tag/v3.17.0
- https://github.com/mlflow/mlflow/commit/bac30b4148c4f40045b4d4db07ae60ab3838803f
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-115886.yaml