Evidence · DiggingBeagle record
MLflow GHSA-2wqp-q3c6-ccj5 unauthenticated third-party scorer SSRF
- Source role
- primary disclosure
Evidence record
Claim-level citations (2)
- supportsMLflow GenAI scorer could trigger outbound requests through LiteLLM: MLflow GHSA-2wqp-q3c6-ccj5 demonstrates SSRF through unconstrained scorer kwargs in an unauthenticated endpoint when trulens and trulens-providers-litellm are installed.
Description: Summary; Details; PoC
- supportsMLflow GenAI scorer could trigger outbound requests through LiteLLM: The GHSA describes SSRF through scorer invoke, register and GenAI evaluate routes when the server is unauthenticated and the optional TruLens LiteLLM integration accepts attacker-chosen scorer parameters.
Summary; affected scoring endpoints; prerequisites