PkgSeer

Vulnerability GHSA-67c5-x5mf-rppq

Critical

4 months ago

MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

3.9.0 - 3.10.0rc0

Summary

MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

Details

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

MLflow AI Gateway permits SSRF through an unvalidated api_base

3.13.0 - 3.15.2 PYSEC-2026-3865

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

2.1.0 - 2.11.4 and 2.12.0 - 2.13.2 and 2.14.0rc0 - 3.14.0 GHSA-gqvg-gmmx-x4hm

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

0.0.1 - 2.11.4 and 2.12.0 - 2.13.2 and 2.14.0rc0 - 3.14.0 PYSEC-2026-3687

MLflow: trace API endpoints lack proper authorization validators

2.14.0rc0 - 3.12.0 PYSEC-2026-3686

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

3.3.0 - 3.14.0 GHSA-7gwp-5pfp-969j

View all vulnerabilities for these packages

Impacted packages

mlflow

Timeline

Published

4 months ago

Fixed (3.10.0)

7 months ago

Last Modified

9 hours ago