ZDI-26-844: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
// AI summary
MLflow get-artifacts discloses sensitive information via CVE-2026-118628, allowing unauthenticated remote attackers to exploit the Server-Side Request Forgery vulnerability.
// from the source
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2026-118628.