Server-Side Request Forgery Vulnerability in MLflow by Databricks
CVE-2026-118628

8.2HIGH

Key Information:

Vendor

Mlflow

Status
Mlflow
Vendor
CVE Published:
3 November 2026

What is CVE-2026-118628?

The vulnerability in MLflow's get-artifacts function arises from inadequate validation of URIs before accessing resources. This flaw allows remote attackers to exploit vulnerable instances, gaining unauthorized access to sensitive information without needing authentication. As a result, attackers can disclose critical data from the server environment, potentially leading to further exploitation or compromise.

Affected Version(s)

MLflow 3.8.0

References

https://www.zerodayinitiative.com/advisories/ZDI-26-844/
x_research-advisory

CVSS V3.0

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.