MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.

Summary MLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke with no authentication, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional trulens + trulens-providers-litellm packages installed, an unauthenticated attacker can force the server to make an outbound HTTP request to an arbitrary host of their choosing, carrying attacker-controlled headers (SSRF). Details Scorer.modelvalidatejson() reflects a class name from a JSON payload behind an import-path allowlist that never constrains the reflected attribute or its kwargs, in mlflow/genai/scorers/base.py:549-604: python data = serialized.thirdpartyscorerdata # attacker JSON modulepath = data.get("module") or "" classname = data.get("class") if not any(modulepath == m or modulepath.startswith(m + ".") for m in THIRDPARTYSCORERALLOWEDMODULES): raise MlflowException.invalidparametervalue(...) module = importlib.importmodule(modulepath) scorerclass = getattr(module, classname, None) # attribute NOT constrained ... initkwargs: dict[str, Any] = dict(data.get("kwargs") or {}) # kwargs NOT constrained ...…

curl https://cve.zerocrew.in/api/cve/CVE-2026-115886