CVE-2026-115886 mlflow CVE debrief

Who should care

Defenders responsible for MLflow deployments, especially those with unauthenticated servers and the optional `trulens` + `trulens-providers-litellm` packages installed, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-115886 is a SSRF vulnerability in MLflow's unauthenticated tracking servers. Defenders should verify exposure, prioritize remediation, and implement compensating controls to prevent potential attacks.

• Potential for SSRF attacks on unauthenticated MLflow servers
• Need for verification of exposure and compensating controls
• Possible data breaches or system compromise
• Required updates to affected MLflow versions

Technical summary

The MLflow tracking server exposes an unauthenticated `POST /ajax-api/3.0/mlflow/scorer/invoke` endpoint that reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional `trulens` + `trulens-providers-litellm` packages installed, an unauthenticated attacker can force the server to make an outbound HTTP request to an arbitrary host, carrying attacker-controlled headers, resulting in a Server-Side Request Forgery (SSRF) vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of unauthenticated MLflow servers, especially those with the optional `trulens` + `trulens-providers-litellm` packages installed, and assess the need for compensating controls or monitoring.

Recommended defensive actions

• Verify exposure of unauthenticated MLflow servers
• Assess the need for compensating controls or monitoring
• Inventory and update affected MLflow versions
• Implement additional security measures for MLflow deployments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides details on the vulnerability in MLflow's tracking server, specifically in the `POST /ajax-api/3.0/mlflow/scorer/invoke` endpoint, which allows for SSRF attacks with attacker-controlled headers when the optional `trulens` + `trulens-providers-litellm` packages are installed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.