MLflow: unauthenticated SSRF in get-artifacts discloses information from the tracking server

Impact

An unauthenticated attacker who can reach the MLflow tracking server's HTTP endpoint can make the server fetch a URI of their choosing and return the contents. On a GPU fleet the tracking server usually sits inside the cluster network with credentials and metadata services nearby, so the response can expose internal endpoints and data that the attacker could not reach directly. The record describes information disclosure in the context of the server, not code execution. Remediation is a service-level change, so experiment tracking is interrupted but GPU nodes are not.

Who can reach it

Anyone who can reach the MLflow tracking server over the network. No authentication required per the advisory.

What to do

Restrict network access to the tracking server and put authentication in front of it; upgrade MLflow once a fixed release is identified - the ZDI advisory in the record does not name a fixed version. Applying a fix means restarting the tracking server process.

References

Related entries

• GitLab AI Gateway: crafted model metadata redirects model requests and discloses Vertex or Bedrock credentialsCVE-2026-19889 · GitLab AI Gateway (Duo Agent Platform model metadata handling)High
• Docker Model Runner (vllm-metal backend): `trust_remote_code=True` set unconditionally, no sandboxCVE-2026-5817 · Docker Model Runner (vllm-metal backend)High
• praktor: unsanitized Telegram upload filename writes outside uploads/ into the persistent agent workspaceCVE-2026-62331 · praktor multi-agent Claude Code orchestrator (Telegram document upload)High
• GitLab AI Gateway: crafted inline flow config overrides the HTTP Host header and leaks Vertex credentialsCVE-2026-75871 · GitLab AI Gateway (Duo Agent Platform inline flow configuration)High
• Gradio: Command injectionCVE-2023-6572 · GradioHigh
• LangChain: Directory traversal via the template path parameterCVE-2024-28088 · LangChainHigh