What happened
MLflow's webhook test endpoint (POST /api/2.0/mlflow/webhooks/{id}/test) is exposed unauthenticated by default and can be coerced into fetching arbitrary internal/cloud-metadata URLs via an HTTP redirect bypass of URL validation, returning the full response body to the attacker (CVSS 9.3 Critical). watchTowr reported attackers actively exploiting this flaw within hours of the CVE being assigned on 2026-08-17 to reach cloud metadata services and exfiltrate credentials/secrets, and detected mass scanning for exposed MLflow instances.
Why it matters
MLflow is one of the most widely deployed open-source ML experiment tracking and model registry platforms; unauthenticated full-read SSRF against a default (no-auth) deployment lets attackers pivot directly to cloud IAM credentials, exposing the entire AI/ML pipeline's cloud environment.
Attack vector
Unauthenticated POST to /api/2.0/mlflow/webhooks/{id}/test triggers a server-side request; _validate_webhook_url() only validates the original URL while the delivery code follows redirects and re-resolves hostnames without pinning the validated address, allowing attackers to redirect the request to internal services or cloud metadata endpoints (e.g., AWS IMDS) and read the reflected response body.
Affected systems
MLflow (open source AI/ML engineering platform for agents, LLMs and ML models) prior to 3.15.0
Mitigation
Upgrade to MLflow >= 3.15.0; review audit logs for webhook-test activity and rotate any cloud credentials that may have been exposed via metadata service access.