BBUGFLARE

Public library

Cybersecurity articles

Automated coverage from researcher feeds — text + code extraction, no thumbnails. Sort by recent, popular, or trending.

GitHub Advisories50
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

### Summary The default MLflow Tracking Server (`mlflow server`, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint that returns the upstream response status and body to the...

Read →

Prefer original Bugflare research? Browse writeups