This vulnerability is a server‑side request forgery in Azure Databricks that allows an unauthorized attacker to send crafted requests to internal services. By exploiting the SSRF flaw, an attacker gains elevated network privileges, potentially accessing internal resources or performing actions beyond their assigned permissions. The weakness is classified as CWE‑918, indicating that the attack involves manipulating a vulnerable component into making unintended HTTP requests.

Microsoft Azure Databricks is affected. No specific version information was provided, so all current deployments of Azure Databricks could be vulnerable unless mitigated by the vendor. Users should review their Azure Databricks environment for applied updates.

The CVSS v3 score is 10, indicating maximum severity. However, the EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. The likely attack vector is network‑based, requiring the attacker to trigger the SSRF from within Azure Databricks, which may privilege-based or require access to certain endpoints. The impact range extends from a single user to the entire Azure Databricks cluster, depending on the privileges the attacker can elevate.