Vulnerability Description
MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Attackers can update a run with a malicious webhook notification that executes when the run reaches a terminal state, enabling requests to internal services, Kubernetes APIs, or cloud metadata endpoints from within the cluster.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/mlrun/mlrun
- https://github.com/mlrun/mlrun/blob/6007f29e8b1ca976ea632e8714a312df50cb13e7/mlr
- https://github.com/mlrun/mlrun/issues/10041
- https://www.vulncheck.com/advisories/mlrun-through-1.11.0-server-side-request-fo
- https://github.com/mlrun/mlrun/issues/10041
FAQ
What is CVE-2026-92568?
CVE-2026-92568 is a vulnerability with a CVSS score of 5.4 (MEDIUM). MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users to make the API server send arbitrary HTTP requests to inte...
How severe is CVE-2026-92568?
CVE-2026-92568 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92568?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.