CVE-2026-64849
MLflow Server-Side Request Forgery Vulnerability
Description
CVE-2026-64849 is a critical server-side request forgery (SSRF) vulnerability in MLflow, the open source AI engineering platform for agents, large language models, and machine learning models. Before version 3.15.0, the unauthenticated webhook test endpoint validates only the originally submitted URL, while the delivery code follows redirects and re-resolves the hostname without pinning the validated address. An attacker can abuse this gap to make the MLflow server request internal services or cloud metadata endpoints and read back the response status and body — without any authentication or user interaction. CISA has added CVE-2026-64849 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, which makes patching MLflow deployments urgent despite the currently modest EPSS score.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| lfprojects | mlflow | < 3.15.0 |
References
- https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939(Patch)
- https://github.com/mlflow/mlflow/issues/24179(Exploit, Issue Tracking, Mitigation)
- https://github.com/mlflow/mlflow/pull/24258(Issue Tracking, Patch)
- https://github.com/mlflow/mlflow/releases/tag/v3.15.0(Release Notes)
- https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j(Exploit, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery occurs when an application fetches a remote resource without properly validating the user-supplied URL, allowing attackers to coerce the server into sending requests to unexpected destinations — even behind firewalls or network access controls. In MLflow, the webhook test endpoint checks the submitted URL once, but the delivery logic then follows redirects and re-resolves the hostname, so the validated address is not the address that is ultimately contacted — a classic validation/time-of-use gap that enables SSRF against internal and cloud metadata services.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2026-64849 carries a CVSS 3.1 score of 9.3 (Critical) and is remotely exploitable without physical access, easy to exploit with no special conditions, and requires neither authentication nor any user action. The changed scope means the attack reaches beyond the vulnerable MLflow component itself: the server can be turned into a proxy against internal services and cloud metadata endpoints such as instance credential APIs. The high confidentiality impact is the core risk — attackers receive the response status and body of internal requests, which can expose cloud credentials, internal API data, and network topology; the low integrity impact reflects that some internal endpoints may also accept state-changing requests. Because CISA lists the vulnerability in the KEV catalog with a remediation due date of 2026-09-02, organizations running MLflow should treat exposed instances as actively targeted, even though the EPSS score of about 1.1% (63rd percentile) does not yet indicate mass exploitation.
Exploit Maturity
Public exploit details are available for CVE-2026-64849: the vulnerability is documented with proof-of-concept information in the MLflow GitHub issue #24179 and the vendor's GHSA-7gwp-5pfp-969j advisory. CISA has confirmed active exploitation in the wild by adding the vulnerability to the KEV catalog with a due date of 2026-09-02; ransomware usage is currently unknown. The EPSS score of about 1.1% (63rd percentile) suggests exploitation is not yet widespread across the internet, but with a public PoC, an unauthenticated network attack path, and confirmed in-the-wild activity, exposed MLflow instances should be patched or isolated immediately.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with vendor instructions, ensure compliance with BOD 26-04 patching guidance, and discontinue use of the product if mitigations are unavailable — the KEV due date is 2026-09-02.
- Upgrade MLflow to version 3.15.0 or later, which fixes the redirect and DNS re-resolution gap in the webhook delivery path (see the official patch commit and the v3.15.0 release notes).
- Until the upgrade is complete, restrict network egress from MLflow hosts: block requests to private IP ranges (10.x.x.x, 172.16–31.x.x, 192.168.x.x, 127.x.x.x) and the cloud metadata address 169.254.169.254, and require IMDSv2 (or the equivalent hardened metadata service) on cloud instances.
- Do not expose the MLflow tracking server — and specifically the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint — to the internet; place it behind authentication, a VPN, or a reverse proxy with access control.
- Review server logs for suspicious webhook test calls and outbound requests to internal addresses or metadata endpoints, and rotate any cloud credentials that an exposed instance could have leaked.
Technical Details
The flaw is a validation/time-of-use mismatch in MLflow's webhook pipeline: the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the originally submitted URL, while mlflow/webhooks/delivery.py subsequently follows HTTP redirects and re-resolves the hostname without pinning the previously validated IP address. An attacker can therefore submit a URL that passes validation and then redirect the delivery request — or let DNS resolve differently at request time — towards internal services or the cloud metadata endpoint. Because the endpoint returns response_status and response_body, this is a full-read SSRF rather than a blind one, matching the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N: network-reachable, low complexity, no privileges, no user interaction, with a scope change into adjacent internal systems and high confidentiality impact.
Frequently Asked Questions
Is CVE-2026-64849 being actively exploited?
Yes. CISA has added CVE-2026-64849 to its Known Exploited Vulnerabilities (KEV) catalog, which confirms active exploitation in the wild, and public exploit details are available via the MLflow security advisory. Ransomware usage is currently listed as unknown.
What products are affected by CVE-2026-64849?
All MLflow versions before 3.15.0 are affected. The vulnerable component is the unauthenticated webhook test endpoint (POST /api/2.0/mlflow/webhooks/{id}/test) of the MLflow tracking server.
How do I fix CVE-2026-64849?
Upgrade MLflow to version 3.15.0 or later, following CISA's KEV required action and BOD 26-04 guidance (due date 2026-09-02). As interim mitigations, block egress from MLflow hosts to private IP ranges and cloud metadata services, and do not expose the tracking server to the internet without authentication.
How severe is CVE-2026-64849?
The vulnerability is rated Critical with a CVSS 3.1 score of 9.3: it is remotely exploitable without authentication or user interaction and lets attackers read responses from internal and cloud metadata services. The EPSS score of about 1.1% places it in the 63rd percentile, but the KEV listing outweighs this — treat it as a patch-now issue.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.