An unauthenticated POST endpoint in MLflow allows attackers to trigger a server‑side request forgery (SSRF) attack (CWE‑918). The endpoint follows HTTP redirects without re‑validating the target hostname, which lets an attacker redirect the server to internal or cloud metadata services. The server then returns the HTTP status code and response body to the attacker, leaking potentially sensitive internal data and enabling unauthorized access.

All MLflow installations using a version earlier than 3.15.0 are affected, regardless of the operating environment. The vulnerability exists in the mlflow/webhooks/delivery.py logic and can be triggered against any webhook identifier exposed via the unsecured test URI. The product is an open‑source AI engineering platform for machine learning workflows.

The CVSS score of 9.3 indicates critical severity, and the EPSS score of 16% indicates a moderately high likelihood of exploitation for any exposed instance. The vulnerability is listed in CISA’s KEV catalog, yet it can be exploited remotely through unauthenticated network traffic. Attackers could use this mechanism to probe internal systems, exfiltrate metadata, and potentially pivot to other services. Immediate remediation is required to prevent data leakage.