MLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke with no authentication. The handler builds a scorer class named in the request and passes attacker-supplied constructor arguments straight through. If the optional trulens and trulens-providers-litellm packages are installed, that is enough to make the server send an outbound HTTP request to an arbitrary host, with attacker-chosen headers (SSRF).

• Affected: mlflow 3.12.0rc0 up to 3.16.x. Fixed: 3.17.0.
• Why it matters: MLflow servers often sit inside ML platforms next to cloud metadata endpoints, model gateways and internal APIs, and are often left on the network without auth.

Upgrade, put MLflow behind authentication, and block its egress to metadata services and internal ranges.