šŸ”“ CVE-2026-64849

CVE-2026-64849 is a critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow's webhook delivery feature. The unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint validates only the original URL while following redirects and re-resolving hostnames without pinning validated addresses, allowing attackers to reach internal services and cloud metadata endpoints (e.g., 169.254.169.254) to steal cloud credentials. It is actively exploited and listed in CISA KEV.

ā† Back to Overview
HIGH_RISK
Risk Level
9.3
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 ā€” Exploit Public-Facing Application
ATT&CK Technique
MEDIUM
Deployment Risk
No
Ransomware

šŸ“‹ Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-17

Added to CISA KEV: 2026-08-19 2 DAYS BETWEEN CVE AND KEV

šŸŽÆ Recommendations:

šŸ” Web Intelligence (Kagi Ā· 2026-09-14)

Summary

CVE-2026-64849 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting the model-registry webhook feature in MLflow, an open-source AI engineering and machine learning platform [6][7]. The flaw stems from insufficient validation of HTTP redirects during the webhook testing process, which allows an unauthenticated remote attacker to bypass destination filters [1][3]. By manipulating these redirects, attackers can force the server to perform unauthorized requests against internal microservices or cloud provider metadata endpoints, posing a significant risk to the security of the underlying infrastructure [1][2].

Exploitation

  • Active Exploitation: The vulnerability is currently being exploited in the wild, with attackers specifically leveraging the SSRF flaw to steal sensitive cloud credentials and secrets [4].
  • Threat Actors: The vulnerability is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active use by malicious actors [5].
  • Availability: Technical details and proof-of-concept vectors have been widely reported due to its active exploitation, though specific automated exploit tool availability is implicitly high given its inclusion in the CISA KEV catalog.
  • Attack Prerequisites:
- Authentication: None required (unauthenticated) [1]. - Interaction: No user interaction is required for successful exploitation [3]. - Access: Exploitation requires network access to the vulnerable MLflow tracking server (specifically the webhook test endpoint) [3].

Affected Products & Patches

  • Affected Versions: MLflow tracking servers prior to version 3.15.0 are affected [1].
  • Patch/Hotfix: Users are advised to upgrade to MLflow version 3.15.0 or later, which contains the fix for the improper redirect handling [1].
  • Mitigation/Workaround: If an immediate update is not possible, organizations should restrict network access to the MLflow webhook endpoints, ensuring they are not exposed to the public internet, and implement strict outbound firewall rules (egress filtering) to block the server from reaching cloud metadata services (e.g., 169.254.169.254) or unauthorized internal resources.

Impact

  • Capability: Successful exploitation allows attackers to gain unauthorized access to internal services that are otherwise unreachable, and retrieve sensitive data such as cloud provider IAM credentials, configuration files, and internal metadata [2][4].
  • Business Risk: For internet-facing deployments, this vulnerability provides a direct pathway for attackers to compromise the entire cloud environment hosting the MLflow instance. Data theft, privilege escalation within the cloud environment, and unauthorized control over CI/CD or AI pipelines are significant risks that could lead to widespread service disruption or permanent data loss [1].

Sources

  1. CVE-2026-64849: CVE-2026-64849: Server-Side Request Forgery (SSRF) in ...

    CVE-2026-64849 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting MLflow tracking servers prior to version 3.15.0. It allows unauthenticated remote attackers to bypass outbound request destination filters using DNS rebinding or HTTP redirects. This exposure risks compromising sā€¦

  2. CVE-2026-64849 - Vulnerability Details - OpenCVE

    An unauthenticated POST endpoint in MLflow allows attackers to trigger a serverā€‘side request forgery (SSRF) attack (CWEā€‘918). The endpoint follows HTTP redirects without reā€‘validating the target hostname, which lets an attacker redirect the server to internal or cloud metadata services. The server tā€¦

  3. CVE-2026-64849 - Red Hat Customer Portal

    A flaw was found in MLflow. An unauthenticated remote attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability by sending a specially crafted request to the webhook test endpoint. This occurs because the system validates only the initial URL, but then follows unvalidated HTTP redirectā€¦

  4. Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

    Attackers exploit MLflow CVE-2026-64849 via SSRF to steal cloud credentials, while FUXA CVE-2026-25895 draws malicious scanning.

  5. CVE-2026-64849 | TenableĀ®

    Details Source: Mitre, NVD Published: 2026-08-18 Updated: 2026-08-20 Known Exploited Vulnerability (KEV) Risk Information CVSS v2 Base Score: 8.5ā€¦

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

šŸ“„ Download JSON Data | šŸ“” RSS Feed