---
title: MLflow: an unauthenticated scorer API lets anyone make the tracking server send requests to any host they choose (CVE-2026-115886), fixed in 3.17.0 | ctxsec
url: https://ctxsec.com/items/mlflow-cve-2026-115886-unauth-scorer-invoke-ssrf
description: ""
status: "confirmed (MLflow advisory, GitHub Advisory Database Oct 23; CVSS 6.5 medium); no exploitation reported"
published: 2026-10-24
---

> 

[← AI](/ai) · [markdown](/items/mlflow-cve-2026-115886-unauth-scorer-invoke-ssrf.md)

confirmed (MLflow advisory, GitHub Advisory Database Oct 23; CVSS 6.5 medium); no exploitation reported

2026-10-24

### MLflow: an unauthenticated scorer API lets anyone make the tracking server send requests to any host they choose (CVE-2026-115886), fixed in 3.17.0

MLflow's tracking server exposes `POST /ajax-api/3.0/mlflow/scorer/invoke` with **no authentication**. The handler builds a scorer class named in the request and passes attacker-supplied constructor arguments straight through. If the optional `trulens` and `trulens-providers-litellm` packages are installed, that is enough to make the server send an outbound HTTP request to an arbitrary host, with attacker-chosen headers (SSRF).

- **Affected:** mlflow 3.12.0rc0 up to 3.16.x. **Fixed:** 3.17.0.
- **Why it matters:** MLflow servers often sit inside ML platforms next to cloud metadata endpoints, model gateways and internal APIs, and are often left on the network without auth.

Upgrade, put MLflow behind authentication, and block its egress to metadata services and internal ranges.

Sources: [MLflow advisory GHSA-2wqp-q3c6-ccj5 / CVE-2026-115886](https://github.com/mlflow/mlflow/security/advisories/GHSA-2wqp-q3c6-ccj5) · [MLflow 3.17.0 release](https://github.com/mlflow/mlflow/releases/tag/v3.17.0)