~ / search / GHSA-wxj7-3fx5-pp9m

GHSA-wxj7-3fx5-pp9m

MLFlow SSRF via gateway_proxy_handler

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-52967

Packages

EcosystemPackageAffectedFixed in
PyPI mlflow >= 3.0.0rc0, < 3.1.0 3.1.0
PyPI mlflow < 2.22.2 2.22.2

Details

As written in the advisory (Markdown source, shown as plain text).

gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.

References

External links from the advisory. They lead to third-party sites.