CVE-2026-64849
published 2026-08-17CVE-2026-64849: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST…
PriorityP191critical9.3CVSS 3.1
AVNACLPRNUINSCCHILAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-09-02
Exploited in the wild
EPSS
16.41%
96.8th percentile
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lfprojects | mlflow | < 3.15.0 | 3.15.0 |
| lfprojects | mlflow | >= 0 < 3.15.0 | 3.15.0 |
| mlflow | mlflow | < 3.15.0 | 3.15.0 |
| rhoai | odh-mlflow-rhel9 | — | — |
CVSS provenance
nvdv3.19.3CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
vulncheck9.3CRITICAL
cisa9.3CRITICAL
vendor_redhat9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
MLflow Server-Side Request Forgery Vulnerability
cisa·2026-08-19·CVSS 9.3
CVE-2026-64849 [CRITICAL] CWE-918 MLflow Server-Side Request Forgery Vulnerability
Vulnerability: MLflow Server-Side Request Forgery Vulnerability
Affected: MLflow MLflow
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://github.com/
Red Hat
mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
vendor_redhat·2026-08-17·CVSS 9.3
CVE-2026-64849 [CRITICAL] CWE-918 mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
A flaw was found in MLflow. An unauthenticated remote attacker can exploit a Server-Side Requ
VulDB
Mlflow up to 3.14.x Webhook Delivery validation.py _validate_webhook_url redirect
vuldb·2026-08-17·CVSS 9.3
CVE-2026-64849 [CRITICAL] Mlflow up to 3.14.x Webhook Delivery validation.py _validate_webhook_url redirect
A vulnerability was found in Mlflow up to 3.14.x. It has been classified as problematic. This affects the function _validate_webhook_url of the file mlflow/utils/validation.py of the component Webhook Delivery. This manipulation causes open redirect.
The identification of this vulnerability is CVE-2026-64849. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
ghsa·2026-08-17
CVE-2026-64849 [CRITICAL] CWE-918 MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
### Summary
The default MLflow Tracking Server (`mlflow server`, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint that returns the upstream response status and body to the caller. The SSRF guard added in PR #20747 (`_validate_webhook_url`, shipped in 3.10.0) resolves the webhook hostname and rejects non-public IPs, but it is bypassable: delivery follows HTTP redirects (no `allow_redirects=False`) and never pins the validated IP. An attacker hosts a public HTTPS endpoint that passes the guard and returns `302 Location: http://
VulnCheck
lfprojects mlflow Server-Side Request Forgery (SSRF)
vulncheck·2026·CVSS 9.3
CVE-2026-64849 [CRITICAL] lfprojects mlflow Server-Side Request Forgery (SSRF)
lfprojects mlflow Server-Side Request Forgery (SSRF)
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
Affected: lfprojects mlflow
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Expl
No detection rules found.
Nuclei
MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass
nuclei·CVSS 9.3
CVE-2026-64849 [CRITICAL] MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass
MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass
MLflow > 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint.
Template:
id: CVE-2026-64849
info:
name: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass
author: DhiyaneshDk
severity: critical
description: |
MLflow > 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint.
impact: |
Attacke
Hackernews
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
blogs_hackernews·2026-08-24
CVE-2026-19478 ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
A package gets installed. A login prompt opens. A box sits exposed to the internet. Nothing looks unusual yet.
That’s roughly the mood this week. Trusted tools turn hostile, old weak spots get fresh attention, AI makes exploit work cheaper, and researchers keep finding attacks that sound harder than they actually are.
Plenty to clean up. Here’s the short version.
## ⚡ Threat of the Week
U.S. Warns of AI-Powered Attacks on Siemens PLCs — Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series program
Hackernews
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
blogs_hackernews·2026-08-18·CVSS 9.8
CVE-2026-64849 [CRITICAL] Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts.
According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows -
CVE-2026-64849 (CVSS score: 9.3) - An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow that can allow an attacker who can reach the Trac
Bugzilla
CVE-2026-64849 mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
bugzilla·2026-08-17·CVSS 9.3
CVE-2026-64849 [CRITICAL] CVE-2026-64849 mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
CVE-2026-64849 mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939https://github.com/mlflow/mlflow/issues/24179https://github.com/mlflow/mlflow/pull/24258https://github.com/mlflow/mlflow/releases/tag/v3.15.0https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969jhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849
2026-08-17
Published
2026-08-19
Added to CISA KEV
Exploited in the wild