What’s Vulnerable › Vulnerabilities
CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability
- Severity: critical (CVSS 9.3 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2026-08-19
- EPSS: 10.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-08-17 · updated 2026-10-26
- Weakness: CWE-918
Description
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
Affected products
- mlflow/mlflow: from 3.3.0 before 3.15.0 — fixed in 3.15.0
How to fix
Upgrade to a fixed version: mlflow/mlflow 3.15.0. Check the vendor advisory for mitigations.
In the news
References
- https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939
- https://github.com/mlflow/mlflow/issues/24179
- https://github.com/mlflow/mlflow/pull/24258
- https://github.com/mlflow/mlflow/releases/tag/v3.15.0
- https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849
Get alerted when CVE-2026-64849 or the next vulnerability affects your stack