Vulnerability record · CVE-2026-64849 · published 17 August 2026
CVE-2026-64849: MLflow unauthenticated webhook test endpoint SSRF via redirect
Lfprojects · Mlflow
MLflow before 3.15.0 validates the webhook URL only on the original request, while the delivery code follows redirects and re-resolves the hostname without pinning the validated address. An unauthenticated attacker can therefore make the server fetch internal or cloud metadata endpoints and read back response_status and response_body. It matters because it exposes internal services and cloud credentials to anyone who can reach the API.
Description
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Automated analysis
critical priorityUnauthenticated network-reachable SSRF with CVSS 9.3, KEV listing and exploit-tagged references, exposing internal services and cloud metadata.
What it is
MLflow before 3.15.0 validates the webhook URL only on the original request, while the delivery code follows redirects and re-resolves the hostname without pinning the validated address. An unauthenticated attacker can therefore make the server fetch internal or cloud metadata endpoints and read back response_status and response_body. It matters because it exposes internal services and cloud credentials to anyone who can reach the API.
Impact
An attacker gains server-side requests to internal networks and cloud metadata services, with response status and body returned to the caller. That can disclose credentials, tokens and internal service data, and the CVSS scope change reflects impact beyond the MLflow component.
Attack surface
Reached over the network through the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint; no authentication or user interaction is required per the vector AV:N/AC:L/PR:N/UI:N. The attacker only needs network access to the MLflow API.
Exploitation
CISA added it to KEV on 2026-08-19 with a 2026-09-02 due date, and references carry Exploit tags, indicating known exploitation. EPSS 30-day probability is 0.1641 (96.8th percentile), so exploitation is plausible at scale.
What to do
- Upgrade MLflow to 3.15.0 or later, which contains the fix.
- If immediate upgrade is not possible, restrict network access to the MLflow API and block outbound traffic from MLflow hosts to internal ranges and cloud metadata addresses (for example 169.254.169.254).
- Require authentication and authorization on the webhook test endpoint and any other unauthenticated administrative API paths.
- Apply CISA BOD 26-04 guidance, including evaluating internet exposure of MLflow instances and discontinuing use where mitigations are unavailable.
- Review webhook configurations and remove or disable unused webhook endpoints.
Detection
- Monitor MLflow logs and outbound network flows for requests from MLflow hosts to internal RFC1918 addresses, loopback, or cloud metadata endpoints.
- Alert on POST requests to /api/2.0/mlflow/webhooks/*/test, especially from unauthenticated or unexpected sources.
- Inspect webhook URLs and redirect chains for hostnames that resolve to internal or metadata IPs, and flag responses returning response_body content from such targets.
- Hunt for cloud metadata credential access patterns (for example requests to 169.254.169.254) originating from MLflow server processes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-64849 to the Known Exploited Vulnerabilities catalog on 19 August 2026 as "MLflow Server-Side Request Forgery Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 2 September 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939 | Patch |
| https://github.com/mlflow/mlflow/issues/24179 | ExploitIssue TrackingMitigation |
| https://github.com/mlflow/mlflow/pull/24258 | Issue TrackingPatch |
| https://github.com/mlflow/mlflow/releases/tag/v3.15.0 | Release Notes |
| https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j | ExploitVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849 | US Government Resource |
Track CVE-2026-64849 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-64849), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
