MLflow: an unauthenticated scorer call makes the server fetch any URL
MLflow's unauthenticated scorer endpoint built an attacker-named class with attacker-supplied arguments, then sent an outbound request.
· MLflow · Research by Adam Jordan
MLflow's scorer invoke endpoint built an attacker-named class with unconstrained arguments and no authentication, letting an unauthenticated caller make the tracking server request any host with chosen headers. Fixed in 3.17.0.
01What happened
MLflow maintainers published advisory GHSA-2wqp-q3c6-ccj5 on 22 October 2026 for CVE-2026-115886, a server-side request forgery flaw in the tracking server. Adam Jordan is credited as the reporter. GitHub added the advisory to its database on 23 October, and the fix ships in MLflow 3.17.0.
02How it works
Scorer deserialization reads a class name and constructor arguments from JSON, and the allowlist checks only the import module path, not the class attribute or the arguments. For the trulens scorer, a model URI outside MLflow's native provider registry routes to a LiteLLM fallback branch that forwards raw arguments, including api_base and api_key, into litellm.completion(). An attacker therefore picks the destination host, headers and body of a request the server itself makes. The advisory notes the deserialization runs before any tracking-store lookup, and the route carries error-handling and artifacts-only decorators but no authentication decorator.
03Who is affected
Tracking servers running mlflow from 3.12.0rc0 up to 3.17.0 are exposed, but only where the optional trulens and trulens-providers-litellm packages are installed, which the advisory describes as a documented but not bundled setup. Servers reachable from untrusted networks are the practical concern, because the endpoint needs no authentication. The advisory rates confidentiality and integrity impact Low.
04What to do
Upgrade MLflow to 3.17.0, whose release notes describe the change as rejecting egress-steering kwargs in third-party scorer payloads. Where an upgrade has to wait, the advisory names the optional trulens and trulens-providers-litellm packages as the precondition, so removing them closes the described path.
Sources 3 links, all fetched
- 1github.comMLflow Advisory
- 2github.comGitHub Advisory DB
- 3github.comMLflow 3.17.0 Release