vuln.management
Act nowKnown exploited

Advisory · CVE-2026-64849

Actively exploited MLflow SSRF can reach cloud metadata

An unauthenticated MLflow webhook test can follow redirects into internal services or cloud metadata endpoints and return their responses.

Advisory published August 19, 2026Independent summary
Vendor
MLflow
Product
MLflow
Identifier / CWE
CVE-2026-64849
CWE-918
Action timing
Sep 2, 2026
ELI5

Explain it like I’m five

MLflow checks the first address on a delivery label but follows any forwarding address without checking again. An attacker can redirect the delivery into private systems and have MLflow bring the response back.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Webhook test

    An unauthenticated attacker calls the MLflow webhook test endpoint with a URL they control.

  2. 02Initial validation

    MLflow validates the original destination before making the request.

  3. 03Redirect follows

    The destination redirects MLflow to a newly resolved internal or cloud metadata address.

  4. 04Private response leaks

    MLflow returns the response status and body, potentially exposing credentials or internal data.

What happened

CISA added CVE-2026-64849 to the Known Exploited Vulnerabilities catalog on August 19, 2026. The GitHub advisory rates it critical at CVSS 9.3 and identifies MLflow releases before 3.15.0 as affected.

The unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint validates the original webhook URL, but the delivery code follows redirects and resolves the destination again without pinning the address that passed validation. An attacker can use that gap to make MLflow request internal services or cloud instance-metadata endpoints and return the response status and body.

For MLflow servers running with cloud identities, this can turn a public application flaw into credential access and lateral movement.

What to do

  1. Inventory MLflow servers, including research, development, demo, and individually managed cloud deployments.
  2. Upgrade affected instances to MLflow 3.15.0 or later using the project release guidance.
  3. Restrict access to MLflow and the webhook test endpoint while remediation is underway.
  4. Review application, proxy, DNS, and cloud audit logs for unusual webhook tests, redirects, link-local addresses, and requests to internal services.
  5. Determine which cloud identities, instance metadata, service tokens, and internal endpoints were reachable from each affected server.
  6. Revoke or rotate credentials if metadata access or other suspicious outbound requests cannot be excluded.
  7. Verify the deployed version and confirm that redirect targets are revalidated after the update.

Management note

This is an actively exploited, unauthenticated path from an AI engineering platform into its surrounding trust boundary. Treat patching and investigation as one task, especially where MLflow runs with cloud permissions or access to model registries and production data.