SSRF in MLflow via user-controlled gateway_path parameter

Description A Server-Side Request Forgery SSRF vulnerability exists in the gatewayproxyhandler function of MLflow. This function accepts a user-controlled gatewaypath parameter and concatenates it directly with a targeturi, allowing an attacker to control the full outbound HTTP request path from...

CVE-2025-52967

creationtimestamp| type| source ---|---|--- 2025-06-23 14:45:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19203 2025-06-23 16:45:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsbzs43cxz2u...

CVE-2025-52967

gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...