MLflow Server-Side Request Forgery (SSRF)

The SSRF vulnerability in MLflow allows an attacker to craft requests that originate from the MLflow server itself, bypassing typical network security controls. This means an attacker could potentially access internal services that are not directly exposed to the internet. In environments utilizing AWS, this vulnerability is particularly concerning. An attacker could leverage the SSRF to interact with AWS metadata services, potentially gaining access to sensitive information like IAM credentials or EC2 instance details. This could then be used to escalate privileges and achieve remote code execution on the affected machine, effectively compromising the entire system. The potential blast radius extends to any internal resources accessible via HTTP(s) from the MLflow server.

Organizations deploying MLflow within AWS environments are particularly at risk, as the SSRF vulnerability can be exploited to gain access to AWS metadata and potentially achieve remote code execution. Teams relying on MLflow for model tracking and deployment, especially those with internal HTTP(s) services accessible from the MLflow server, should prioritize patching.

• python / mlflow:

import mlflow
import requests

try:
    response = mlflow.tracking.MlflowClient().tracking_service.get_endpoints()
    print(response)
except requests.exceptions.RequestException as e:
    print(f"Error: {e}")

• linux / server:

journalctl -u mlflow -g 'SSRF' | grep -i error

• generic web:

curl -I <mlflow_endpoint>/some/internal/resource

1. 2023-12-20Disclosure

   disclosure

2. 2023-12-20Patch

   patch

1. Réservé2023-12-20
2. Publiée2023-12-20
3. Modifiée2025-02-14
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2023-6974 is to upgrade MLflow to version 2.9.2 or later, which contains the fix. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. Restricting network access from the MLflow server to only necessary internal resources can limit the potential impact of the SSRF. Implementing a Web Application Firewall (WAF) with strict outbound filtering rules can also help block malicious requests. Carefully review and restrict the allowed protocols and domains that MLflow can access. After upgrading, confirm the fix by attempting to access an internal HTTP(s) resource through the MLflow UI; the request should be blocked or denied.