Server Side Request Forgery (SSRF)

mlflow is vulnerable to missing input validation. The vulnerability is due to missing validation of the gatewaypath parameter in the gatewayproxyhandler function, allowing an attacker to manipulate the request path to access unintended internal endpoints or services...