A Server‑Side Request Forgery flaw exists in MLflow versions earlier than 3.9.0. The _create_webhook() routine accepts a user‑supplied url argument without validation; this url is later handed directly to _send_webhook_request() which posts to the chosen address. Consequently, an attacker who can create a webhook can instruct the MLflow server to send HTTP requests to arbitrary URLs, including internal network resources, cloud metadata services, or external domains. The lack of input sanitization, scheme filtering, or allow‑list validation means that the attacker can easily request cloud‑credential endpoints, potentially enabling credential theft, internal reconnaissance, and data exfiltration. }

The vulnerability affects the mlflow/sdk and web backend component, officially identified as mlflow:mlflow/mlflow. Any deployment running MLflow 3.8.x or earlier is susceptible; version 3.9.0 and later contain the fix. Endpoints that expose the webhook create handler are the attack vector. }

The calculated CVSS base score of 7.1 classifies this flaw as a high‑severity vulnerability. No EPSS data is available, yet the attack requires only an authenticated user with permission to create a webhook, a common privilege in many MLflow installations. Since the flaw is not listed in the CISA KEV catalog, there is no current evidence of active exploitation, but the nature of SSRF makes it attractive for attackers seeking cloud‑metadata access. The attacker could feasibly learn internal IP addresses, request instance metadata, and use that to obtain access keys or tokens, leading to further compromise.