A Server-Side Request Forgery vulnerability in MLflow versions prior to 3.15.0 allows unauthenticated remote attackers to access internal network resources and cloud metadata services.

The vulnerability exists in the webhook test functionality, which validates the initial URL but fails to pin the address after following redirects. An unauthenticated attacker can supply a malicious URL that redirects to internal infrastructure, bypassing security controls.

An attacker can use this SSRF to scan internal network segments, access sensitive cloud metadata services, or interact with other internal APIs. Given the critical CVSS score of 9.3, the ability for an unauthenticated attacker to pivot into internal infrastructure presents a major risk of data exfiltration and further compromise.

Immediate Action: Update MLflow to version 3.15.0 or later to ensure proper validation of redirected webhook URLs.

Proactive Monitoring: Monitor egress traffic from MLflow servers for connections to internal IP addresses or unauthorized cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Use a Web Application Firewall or egress filtering to block requests originating from the MLflow service to internal or sensitive network ranges.

Public Exploit Available: exploit_available (unknown)

The risk of unauthorized internal access via this SSRF vulnerability is high. Administrators must update to the latest version of MLflow immediately and implement network-level egress restrictions as a defense-in-depth measure until the update is deployed.