An unauthenticated endpoint in MLflow allows attackers to send POST requests to the webhook test URL, which follows HTTP redirects without re‑validating the target hostname. When redirects point to internal or cloud metadata services, the attacker receives the HTTP status code and body of the response, exposing potentially sensitive internal information and enabling unauthorized data access.

All MLflow installations using a version earlier than 3.15.0 are affected, regardless of the operating environment. The vulnerability exists in the __mlflow/webhooks/delivery.py__ logic and can be triggered against any webhook identifier exposed via the unsecured test URI. The product is an open‑source AI engineering platform for machine learning workflows.

The CVSS score of 9.3 indicates critical severity, and the lack of a publicly available EPSS score suggests the probability of exploitation is uncertain but worth treating as high for any exposed instance. The vulnerability is not currently listed in CISA’s KEV catalog, yet it can be exploited remotely through unauthenticated network traffic. Attackers could use this mechanism to probe internal systems, exfiltrate metadata, and potentially pivot to other services. Immediate remediation is required to prevent data leakage.