Who is affected
MLflow Server contains a server-side request forgery (SSRF) vulnerability. The flaw allows remote attackers to make the MLflow instance issue requests to internal or cloud metadata services, reading back response status and body content. This affects any organisation running MLflow as a service, whether on-premises or in cloud environments.
How to check whether this touches you
- Inventory your MLflow deployments: check whether you run MLflow Server, and in which environments (on-premises, AWS, Azure, GCP, or other cloud).
- Determine network exposure: establish whether each MLflow instance is reachable from untrusted networks—check ingress rules, DNS records, and whether it sits behind a load balancer or API gateway.
- Confirm the running version: query the MLflow service version via its web interface or API; note that security patches may be backported to earlier minor versions by your distributor.
- Check access logs for suspicious requests: look for unusual URI patterns, repeated metadata service URLs, or requests from unexpected IP ranges pointing to internal services.
What to do
- If you cannot patch immediately, restrict network access to MLflow Server to only trusted clients and internal networks; use firewall rules, security groups, or network policies to deny external inbound connections.
- Review and tighten IAM policies on the host or container running MLflow to limit its outbound access to only required services; disable access to cloud metadata endpoints if possible.
- Enable and review access logs for the MLflow service, looking for requests that target internal IP ranges, localhost, or known cloud metadata service endpoints (such as 169.254.169.254).
- Apply the vendor's patch or mitigations as soon as feasible, following CISA BOD 26-04 guidance for your environment and asset classification.
- If mitigations or patches are unavailable for your deployment model, escalate to leadership and consider discontinuing use of the product pending vendor remediation.
If you find you were exposed
Exploitation of SSRF vulnerabilities typically occurs before public disclosure, so review access and request logs covering the period back to the vulnerability's likely introduction date. Pay particular attention to outbound connections from the MLflow host to internal services, cloud metadata endpoints, or other sensitive infrastructure. Log retention policies often limit historical visibility; prioritise retention of access logs and network flow data for MLflow instances going forward, and document any suspicious patterns you find for incident investigation.