Live › vulnerability › CVE-2026-118628
ZDI-26-844: MLflow's get-artifacts function does not validate a URI before accessing it, so a remote unauthenticated attacker can make the server connect to hosts of their choosing and disclose information in the server's context (CVSS 8.2). ZDI says it is fixed in MLflow 3.17.0. The upstream fix makes the tracking server refuse artifact locations on hosts other than its default artifact root or artifacts destination. No exploitation or public PoC found in the sources read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
MLflow tracking servers older than 3.17.0 that a remote user can reach over the network. ZDI lists no login requirement. Look at self-hosted MLflow servers, especially ones exposed beyond a trusted network or with access to internal services or cloud metadata. The lower bound of affected versions is not stated by ZDI or the PR; managed MLflow offerings were not checked.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mlflow | pypi | < 3.17.0 | 3.17.0 |
pip show mlflow or mlflow --version on every tracking server; versions below 3.17.0 lack the fix.3.17.0 or later (fix: mlflow PR #25891, GHSA-mr9f-g8qf-4w4j)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the get-artifacts function. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the server. Was ZDI-CAN-28192.
This page as .md · .json · in your agent: get_signal("CVE-2026-118628")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.