CVE-2026-115886: Unauthenticated Server-Side Request Forgery and Unsafe Reflection in MLflow Scorer Evaluation Endpoints

Vulnerability ID: CVE-2026-115886
CVSS Score: 6.5
Published: 2026-10-23

CVE-2026-115886 (GHSA-2wqp-q3c6-ccj5) is a Server-Side Request Forgery (SSRF) and Unsafe Reflection vulnerability in MLflow versions 3.12.0rc0 prior to 3.17.0. Unauthenticated REST API endpoints accept serialized third-party scorer JSON payloads that are dynamically deserialized and reflectively instantiated without sanitizing constructor keyword arguments. When optional dependencies such as trulens and trulens-providers-litellm are installed, attackers can inject egress-steering arguments into the scorer payload, forcing the MLflow server to dispatch outbound HTTP requests to arbitrary internal destinations or cloud metadata services.

TL;DR

MLflow versions 3.12.0rc0 through 3.16.x fail to validate constructor keyword arguments during the reflective instantiation of serialized third-party scorers across multiple unauthenticated REST API endpoints. When optional LiteLLM-backed evaluation packages are present, an unauthenticated attacker can supply destination-override parameters such as api_base or base_url to trigger Server-Side Request Forgery (SSRF). Upgrading to MLflow 3.17.0 remediates the flaw by recursively inspecting and rejecting egress-steering keys prior to scorer deserialization.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-115886 (GHSA-2wqp-q3c6-ccj5)
• Primary CWE: CWE-918 (SSRF) & CWE-470 (Unsafe Reflection)
• CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
• Attack Vector: Unauthenticated HTTP POST to /ajax-api/3.0/mlflow/scorer/* endpoints
• Affected Versions: MLflow >= 3.12.0rc0, < 3.17.0
• Patched Version: MLflow 3.17.0
• Exploit Status: Proof-of-Concept (PoC) Available
• CISA KEV Status: Not Listed

Affected Systems

• MLflow Tracking Server
• mlflow Python package
• mlflow: >= 3.12.0rc0, < 3.17.0 (Fixed in: 3.17.0)

Code Analysis

Commit: bac30b4

Reject egress-steering kwargs in third-party scorer payloads (GHSA-2wqp-q3c6-ccj5) (#25890)

Mitigation Strategies

• Upgrade MLflow to version 3.17.0 or later to enforce server-side validation against egress-steering keyword arguments in third-party scorers.
• Enable authentication on the MLflow Tracking Server (--app-name basic-auth) or deploy an authenticating reverse proxy in front of all /ajax-api/ endpoints.
• Restrict outbound network egress from the MLflow server host to block unauthorized connections to RFC 1918 internal networks and cloud metadata services (169.254.169.254).
• Enforce Instance Metadata Service Version 2 (IMDSv2) on cloud compute instances hosting MLflow.
• Audit and remove unneeded optional evaluation packages such as trulens and trulens-providers-litellm from the MLflow runtime environment.

Remediation Steps:

1. Update the mlflow Python package in the server environment using pip: pip install --upgrade 'mlflow>=3.17.0'.
2. Restart the MLflow Tracking Server service and verify the running version via mlflow --version.
3. Migrate any legitimate third-party scorer configurations that previously used inline api_base or base_url arguments to use server-configured MLflow Gateway endpoints (gateway:/) or host environment variables.
4. Audit the MLflow tracking store for previously registered scorers containing third_party_scorer_data and remove or update any suspicious definitions.

References

• GitHub Security Advisory: GHSA-2wqp-q3c6-ccj5
• Official Security Patch Commit (bac30b4148c4f40045b4d4db07ae60ab3838803f)
• GitHub Pull Request #25890: Reject egress-steering kwargs in third-party scorer payloads
• MLflow v3.17.0 Release
• NVD Vulnerability Record: CVE-2026-115886
• CVE.org Record: CVE-2026-115886
• cvelistV5 JSON Record: CVE-2026-115886

Read the full report for CVE-2026-115886 on our website for more details including interactive diagrams and full exploit analysis.