The MLflow scorer endpoint reflected an attacker-selected scorer class and constructor parameters from JSON. With an optional TruLens provider installed, those parameters could select a LiteLLM backend and supply a network endpoint, making the exposed tracking server send an HTTP request to an attacker-chosen address. The published proof of concept used an…
Inspect the ClaimsCase · DiggingBeagle record
MLflow GenAI scorer could trigger outbound requests through LiteLLM
An unauthenticated MLflow endpoint accepted third-party scorer initialization parameters that could reach an outbound LiteLLM client under optional TruLens dependencies.
Scope
MLflow >=3.12.0rc0 <3.17.0, unauthenticated tracking server, optional TruLens LiteLLM provider installed.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
CASE-2026-MLFLOW-GENAI-SCORER-SSRF: MLflow GHSA-2wqp-q3c6-ccj5 demonstrates SSRF through unconstrained scorer kwargs in an unauthenticated endpoint when trulens and trulens-providers-litellm are installed. Evidence comes from SRC-2026-MLFLOW-SSRF-2WQP. Published technical statements or controlled results are not verified production-loss counts. No impact band is assigned because the observed outcome and its denominator do not establish a comparable severity measure.
Assessed Oct 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MLFLOW-SSRF-01 · MLflow GHSA-2wqp-q3c6-ccj5 unauthenticated third-party scorer SSRF
At a glance
This is a delegated-connectivity failure in an AI evaluation tool: model scoring needs external providers, but users controlling scorer instantiation must not decide arbitrary network destinations. The optional TruLens provider and unauthenticated endpoint are essential preconditions.
Read the implicationsNo confirmed compromise of a particular hosted MLflow tracking instance is documented.
Limits and uncertaintyFull account
The MLflow scorer endpoint reflected an attacker-selected scorer class and constructor parameters from JSON. With an optional TruLens provider installed, those parameters could select a LiteLLM backend and supply a network endpoint, making the exposed tracking server send an HTTP request to an attacker-chosen address. The published proof of concept used an attacker-provided canary token; it did not show theft of an MLflow server secret. The advisory identifies 3.17.0 as the fix and makes the optional dependency and unauthenticated server conditions explicit. This is an ML evaluation-service boundary, not a model spontaneously deciding to call a malicious URL, and not a repeat of the compromised LiteLLM distribution incident.
The model-evaluation label is a poor indicator of trustworthiness here. An unauthenticated evaluation endpoint could let a caller supply scorer arguments that ultimately shaped network calls through the LiteLLM integration. The essential failure is that an evaluation request crosses into the server's outbound network identity, potentially reaching resources unavailable to the original client. It is not evidence that LiteLLM itself executed an autonomous attack; the scorer was the entry point and the host's network privileges set the impact. Maintainer advisory.
Mechanism and trust boundary
- 01
Expose a GenAI evaluation endpoint
An MLflow tracking server accepts external scorer evaluation requests without application authentication in the affected configuration.
Boundary: External requester / evaluation service
- 02
Supply scorer class and constructor kwargs
Attacker-selected parameters reach an optional TruLens/LiteLLM provider that can be configured with an outbound base URL.
Boundary: Caller-provided scorer configuration / outbound model provider
- 03
Cause the server to fetch an arbitrary URL
The server originates a request using its own network access. Metadata access, readback or credentials depend on destination behavior and environment; they are not universally demonstrated.
Boundary: MLflow process identity / internal or external network
Timeline
- 2026-10 (month precision)Event type unspecified
MLflow GenAI scorer SSRF advisory
Researchers documented a third-party scorer configuration path reaching outbound LiteLLM behavior.
- Oct 22, 2026disclosure
Public disclosure
Claims & evidence
CLM-MLFLOW-SSRF-01MLflow GHSA-2wqp-q3c6-ccj5 demonstrates SSRF through unconstrained scorer kwargs in an unauthenticated endpoint when trulens and trulens-providers-litellm are installed.supported
Basis: reported finding
- supportsMLflow GHSA-2wqp-q3c6-ccj5 unauthenticated third-party scorer SSRFprimary disclosure
Description: Summary; Details; PoC
CLM-MLFLOW-ENRICH-CONFIGThe GHSA describes SSRF through scorer invoke, register and GenAI evaluate routes when the server is unauthenticated and the optional TruLens LiteLLM integration accepts attacker-chosen scorer parameters.supported
Basis: reported finding
- supportsMLflow GHSA-2wqp-q3c6-ccj5 unauthenticated third-party scorer SSRFprimary disclosure
Summary; affected scoring endpoints; prerequisites
Implications
This is a delegated-connectivity failure in an AI evaluation tool: model scoring needs external providers, but users controlling scorer instantiation must not decide arbitrary network destinations. The optional TruLens provider and unauthenticated endpoint are essential preconditions.
Controls and mitigations
- Upgrade MLflow to 3.17.0 or later, authenticate exposed tracking/evaluation APIs, and impose server-side allowlists and network egress restrictions for scorer provider URLs.
Unknowns and contradictions
- No confirmed compromise of a particular hosted MLflow tracking instance is documented.
Sources and citation
Material revision history
- Oct 24, 2026 · Canonical change recorded · new in release · revision 188