ZDI-26-847 (CVE-2026-71211): MLflow AI Gateway flaw lets authenticated users trigger SSRF and information disclosure. CVSS 7.7 fix adds public IP validation by default. https://deafnews.it/en/article/mlflow-ai-gateway-arbitrary-endpoint-flexibility-turns-into-ssrf
DeafNewsMLflow AI Gateway: Arbitrary Endpoint Flexibility Turns into SSRF | DeafNewsZDI-26-847 (CVE-2026-71211) exposes an SSRF and information disclosure flaw in MLflow AI Gateway exploitable by authenticated users. The CVSS 7.7 fix enforces public IP validation by default and requires explicit overrides for on-premise deployments.