Description
MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Attackers can update a run with a malicious webhook notification that executes when the run reaches a terminal state, enabling requests to internal services, Kubernetes APIs, or cloud metadata endpoints from within the cluster.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
mlrun mlrun
Default version status: unaffected
0 to ≤ 1.11.0affected
pkg:pypi/mlrunReferences
- https://github.com/mlrun/mlrun/issues/10041 ↗
- https://github.com/mlrun/mlrun ↗
- https://github.com/mlrun/mlrun/blob/6007f29e8b1ca976ea632e8714a312df50cb13e7/mlrun/utils/notifications/notification/webhook.py#L33-L94 ↗
- https://www.vulncheck.com/advisories/mlrun-through-1.11.0-server-side-request-forgery-via-webhook ↗