{"id":"CVE-2026-118628","kind":"vulnerability","aliases":["CVE-2026-118628"],"related":[],"title":"MLflow: get-artifacts endpoint lets remote users read server-side data","description":"MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the get-artifacts function. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the server. Was ZDI-CAN-28192.","summary":"ZDI-26-844: MLflow's get-artifacts function does not validate a URI before accessing it, so a remote unauthenticated attacker can make the server connect to hosts of their choosing and disclose information in the server's context (CVSS 8.2). ZDI says it is fixed in MLflow 3.17.0. The upstream fix makes the tracking server refuse artifact locations on hosts other than its default artifact root or artifacts destination. No exploitation or public PoC found in the sources read.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mlflow","fixed":["3.17.0"],"affected":"< 3.17.0","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","ml-platform","mlflow","python","self-hosted","ssrf","unauthenticated"],"not_affected_if":["auth-required","managed-hosting","not-network-reachable"],"how_to_check":"- Run `pip show mlflow` or `mlflow --version` on every tracking server; versions below 3.17.0 lack the fix.\n- Check whether the tracking server is reachable from the internet or untrusted networks; ZDI says no authentication is needed.\n- Also check experiments' artifact_location and model version sources for hosts you do not recognize (ftp, sftp, hdfs, http/https and similar); the fix rejects those not matching the server's default artifact root.","fix":"Upgrade MLflow to 3.17.0 or later (fix: mlflow PR #25891, GHSA-mr9f-g8qf-4w4j). If your artifact store is on a different host than --default-artifact-root / --artifacts-destination, set MLFLOW_ALLOWED_HOST_ADDRESSED_ARTIFACT_SCHEMES to the schemes you need after upgrading.","status":"open","published_at":"2026-11-04T00:17:24+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:47:45+00:00","updated_at":"2026-11-04T00:48:49+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-04T00:47:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MLflow: get-artifacts endpoint lets remote users read server-side data","impact":"medium","summary":"MLflow's get-artifacts function does not validate a supplied URI before fetching it, so a remote attacker can make the server request internal resources. The attacker gets sensitive information from the server's context, and no login is needed.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mlflow","self-hosted","python","ml-platform"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Server-side requests reveal internal data and sensitive information to the attacker","analyst_note":"Find the affected and fixed MLflow versions and the vendor advisory, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-118628 and the ZDI advisory it cites (ZDI-CAN-28192).","how_to_check":"- Check the MLflow version with `pip show mlflow` or `mlflow --version` on every tracking server\n- Confirm whether the tracking server is reachable from the internet or untrusted networks\n- unknown for the exact affected version range","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required"],"who_is_affected":"Teams running an MLflow tracking server that accepts requests from users or networks they do not fully trust. Installations that keep the server on a private network with access limited to trusted users are less exposed. The sources do not state the affected version range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":4192,"output_tokens":572,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed MLflow versions and the vendor advisory, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-118628 and the ZDI advisory it cites (ZDI-CAN-28192).","search":"'-118628':16A,19A '-2026':15A,18A '-26':35B '-844':36B '28192':194C '3.17.0':83B '8.2':75B 'access':49B,173C 'affect':137C 'ai':22B 'ai-tool':21B 'allow':129C 'artifact':4A,41B,92B,100B,103B,118C,157C 'attack':55B,131C,176C 'authent':141C 'choos':65B 'connect':60B 'context':73B,186C 'cve':14A,17A 'cvss':74B 'data':13A 'default':99B 'destin':104B 'disclos':67B,133C,182C 'disclosur':125C 'endpoint':5A 'exist':152C 'exploit':106B,146C 'fix':80B,86B 'flaw':151C 'forgeri':123C 'found':110B 'function':42B,158C 'get':3A,40B,117C,156C 'get-artifact':2A,39B,116C,155C 'host':31B,62B,95B 'inform':68B,124C,135C,183C 'instal':138C 'issu':160C 'lack':164C 'let':6A 'leverag':178C 'locat':93B 'make':57B,87B 'ml':25B 'ml-platform':24B 'mlflow':1A,20A,27B,37B,82B,115C,140C 'platform':26B 'poc':109B 'prior':171C 'proper':166C 'public':108B 'python':28B 'read':9A,114B 'refus':91B 'remot':7A,53B,130C 'request':122C 'requir':144C 'resourc':174C 'result':161C 'root':101B 'say':77B 'self':30B 'self-host':29B 'sensit':134C 'server':11A,59B,71B,90B,120C,189C 'server-sid':10A,119C 'side':12A,121C 'sourc':113B 'specif':150C 'ssrf':32B 'tool':23B 'track':89B 'unauthent':33B,54B 'upstream':85B 'uri':47B,170C 'user':8A 'valid':45B,167C 'vulner':126C,128C,148C,180C 'within':153C 'zdi':34B,76B,192C 'zdi-can':191C","nicknames":[],"mitigations":[],"who_affected":"MLflow tracking servers older than 3.17.0 that a remote user can reach over the network. ZDI lists no login requirement. Look at self-hosted MLflow servers, especially ones exposed beyond a trusted network or with access to internal services or cloud metadata. The lower bound of affected versions is not stated by ZDI or the PR; managed MLflow offerings were not checked.","tier":"B","verified":{"fix":{"at":"2026-11-04T00:48:49Z","by":"analyst","doc":"https://github.com/mlflow/mlflow/pull/25891","run_id":1586}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mlflow"],"ptokens":["mlflow"],"labels":["aitooling","high","mlflow","mlplatform","python","selfhosted","ssrf","unauthenticated"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118628","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118628","severity":null,"published_at":"2026-11-04T00:17:24+00:00","modified_at":"2026-11-04T00:17:24+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118628:1586","url":null,"severity":null,"published_at":"2026-11-04T00:48:49+00:00","modified_at":"2026-11-04T00:48:49+00:00","first_seen_at":"2026-11-04T00:48:49+00:00","fetched_at":"2026-11-04T00:48:49+00:00","note":"ZDI-26-844 says fixed in 3.17.0 and links PR #25891 (GHSA-mr9f-g8qf-4w4j, SSRF via client-named artifact hosts). NVD page returned empty; GHSA page unreachable. Affected lower bound unknown; 3.17.0 only from ZDI. X not searched. Fix verified from ZDI/PR only."}],"documents":[{"id":62149,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-844/","title":"ZDI-26-844 MLflow get-artifacts SSRF","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":62150,"url":"https://github.com/mlflow/mlflow/pull/25891","title":"mlflow PR 25891: refuse client-named artifact hosts (GHSA-mr9f-g8qf-4w4j)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}