# CVE-2026-115886: MLflow - SSRF

> Live exploitation tracking for CVE-2026-115886 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-115886

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **CVSS score:** 6.5
- **Public exploit available:** Yes
- **Affected products:** MLflow
- **Weaknesses:** CWE-470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')); CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** web_application, enterprise_software

## Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission. This issue is fixed in version 3.17.0.

## CrowdSec analysis

[CVE-2026-115886](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-115886) is a server-side request forgery (SSRF) vulnerability in MLflow versions 3.12.0rc0 through 3.16.x, where unauthenticated scorer endpoints can process crafted serialized data and trigger outbound requests to attacker-controlled or internal hosts. The attack requires the optional TruLens and LiteLLM provider packages to be installed and may expose internal services or enable requests with attacker-controlled headers and content; the issue is fixed in MLflow 3.17.0.

CrowdSec has been tracking this vulnerability and its exploits since 28th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-115886 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed exploitation attempts target `/ajax-api/3.0/mlflow/scorer/invoke` with crafted `serialized_scorer` data. The attacker supplies an `api_base` URL to induce the MLflow server to make outbound requests to attacker-controlled or internal hosts.

## Timeline

- 2026-10-23: CVE Published. CVE-2026-115886 is published to NVD.
- 2026-10-28: Rule Released. CrowdSec releases a rule to detect CVE-2026-115886 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/mlflow/mlflow/security/advisories/GHSA-2wqp-q3c6-ccj5
- https://github.com/mlflow/mlflow/pull/25890
- https://github.com/mlflow/mlflow/releases/tag/v3.17.0
- https://github.com/mlflow/mlflow/commit/bac30b4148c4f40045b4d4db07ae60ab3838803f
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-115886.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-115886) follows observed exploitation activity for CVE-2026-115886. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.