MLflow scorer invoke/register/GenAI-evaluate deserialization leads to unauthenticated SSRF with attacker-controlled outbound requests

CVE-2026-115886 (CWE-470 unsafe reflection / CWE-918 SSRF) is a deserialization-to-SSRF flaw in MLflow's scorer and GenAI-evaluate endpoints, published 2026-10-23. The vulnerable deserialization happens before a tracking-store lookup or job submission, and the attacker can drive the LiteLLM fallback to make an outbound request to an internal host with attacker-controlled headers and body.

MLflow is broadly deployed as the tracking/model-registry layer in MLOps and GenAI pipelines. Because the affected endpooints accept unauthenticated serialized input and can be steered into SSRF against internal services (including cloud metadata endpoints and internal model/agent backends), this gives an external attacker a foothold into an AI deployment's internal network — a classic abuse path from an ML platform to the surrounding infrastructure.

An unauthenticated attacker POSTs serialized third-party scorer data to the scorer/GenAI-evaluate endpoints. Scorer.model_validate_json resolves the class via a module-path allowlist without constraining the selected class or its constructor arguments. With trulens/trulens-providers-litellm installed, the attacker can select mlflow.genai.scorers.trulens, point the model URI outside MLflow's native provider registry so execution falls to the LiteLLM fallback, and supply api_base/api_key values that cause the server to issue an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body.

MLflow >= 3.12.0rc0, < 3.17.0

Upgrade to MLflow 3.17.0 (fix commit bac30b4; advisory GHSA-2wqp-q3c6-ccj5). Workaround: do not install the optional trulens/trulens-providers-litellm packages if scorer endpoints are exposed, and do not expose /ajax-api/.../scorer/invoke unauthenticated.