CVE-2026-118628

MLflow artifact URLs can direct the tracking server to another host

MLflow · Tracking Server artifact retrieval

First documented disclosure · Review checkpoint

Summary

A client-controlled artifact location can direct server requests to destinations reachable from the tracking environment.

Severity and exploitation evidence

High · 8.2/10 · CVSS 3.0. Severity source.

Exploitation not established: The disclosure and project fix describe the weakness. The reviewed sources report no confirmed malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The server stores client-supplied locations and later resolves certain host-addressed URIs through artifact backends without checking the host and port against configured storage.

Conditions required

An attacker can submit or influence a location that the server later dereferences, and the selected backend can reach the destination. ZDI rates the attack unauthenticated.

Potential impact

Server-side request forgery can expose information available from the server’s network position. The outcome depends on the protocol, reachable service and returned data.

Affected versions and configurations

ZDI identifies MLflow 3.8.0 as affected. The CNA does not specify the full vulnerable range.

Fix and mitigation status

ZDI identifies 3.17.0 as fixed for this issue.

Practical next steps

Upgrade to a supported release containing the 3.17.0 host policy. Keep the list of extra allowed URI schemes empty unless required and restrict outbound access from tracking workers.

Operating lesson

Check artifact destinations both when recording a location and when a worker later retrieves it.

Evidence and limits

The fix compares scheme family, host and effective port to operator-configured storage. Allowing an entire extra scheme expands reachable destinations. This issue concerns artifact URIs and is distinct from the previously registered webhook and scorer SSRFs. The public project change predates the October 29 ZDI advisory and November 3 CNA record.

Sources