Server-side Request Forgery (SSRF) Affecting mlflow package, versions [,3.0.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-MLFLOW-10494137
- published24 Jun 2025
- disclosed23 Jun 2025
- creditJinho Seo
Introduced: 23 Jun 2025
NewCVE-2025-52967 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade mlflow to version 3.0.0 or higher.
Overview
mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via insufficient validation of the gateway_path parameter in the gateway_proxy_handler process. An attacker can interact with unintended internal resources by supplying crafted input to bypass access controls.