{"id":"CVE-2026-64849","kind":"vulnerability","aliases":["CVE-2026-64849"],"related":[],"title":"lfprojects mlflow: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models","description":"MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"MLflow Tracking Server's unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint is an SSRF. The URL guard is bypassed through HTTP redirects and DNS rebinding, so an attacker can reach cloud metadata (169.254.169.254) or internal services and read the response body. The usual result is theft of cloud IAM credentials. CVSS 9.3 (CNA GitHub). Exploited in the wild and listed in CISA KEV.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2026-08-19T00:00:00+00:00","products":[{"name":"MLflow MLflow","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"mlflow","fixed":["3.15.0"],"affected":">= 3.10.0, < 3.15.0","ecosystem":"pip"},{"name":"lfprojects mlflow","fixed":["3.15.0"],"affected":">= 3.3.0, < 3.15.0","ecosystem":"vendor"}],"ecosystems":["pip","vendor"],"tags":["ai-tooling","cloud","exploited","mlflow","poc-public","python","self-hosted","ssrf"],"not_affected_if":["auth-required","managed-hosting","no-mlflow-server"],"how_to_check":"Run 'pip show mlflow' (or 'mlflow --version') on each host or container image running 'mlflow server'. Versions >= 3.10.0 and < 3.15.0 are vulnerable. Check whether the server is reachable without authentication. Review registry webhooks for unknown URLs. Check cloud audit logs (CloudTrail etc.) for use of the host's IAM role from unfamiliar IPs.","fix":"Upgrade mlflow to 3.15.0 or later (pip install -U 'mlflow>=3.15.0'). If you can't patch yet, block egress from the server to 169.254.169.254, enforce IMDSv2, and put the server behind authentication or a VPN. If it was exposed while unpatched, rotate the credentials of the host's IAM role, managed identity or service account.","status":"open","published_at":"2026-08-17T22:17:23+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:54+00:00","updated_at":"2026-10-25T09:38:59+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-10-23T20:31:54Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patched MLflow version; the sources do not name the fixed version. Follow CISA BOD 26-04 guidance; if no mitigation exists, stop exposing the MLflow server.","summary":"MLflow, an open-source ML experiment tracking and model registry server, has a server-side request forgery flaw. An attacker can make the server request internal or cloud metadata endpoints and read the response status and body back.","category":"ai-tooling","who_cares":["mlflow","self-hosted","cloud"],"confidence":0.6,"analyst_note":"Find the affected and fixed MLflow versions and the vendor advisory via the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849 and the MLflow GitHub security advisories.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-mlflow-server"],"severity_if_unknown":"high"},"cost_usd":0.000394,"input_tokens":2188,"output_tokens":351,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed MLflow versions and the vendor advisory via the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849 and the MLflow GitHub security advisories.","search":"'-04':151C,177C,208C '-2026':21A,24A '-64849':22A,25A '/api/2.0/mlflow/webhooks':51B '/test':53B '169.254.169.254':76B '26':150C,176C,207C '9.3':95B 'accord':140C 'action':136C 'adher':204C 'agent':12A 'ai':8A,32B 'ai-tool':31B 'allow':118C 'appli':137C 'applic':174C 'asset':198C 'attack':71B,119C 'base':155C 'bod':149C,175C,206C 'bodi':84B,133C 'bypass':62B 'cisa':105B,134C,147C,164C 'cloud':34B,74B,91B,124C,180C 'cna':96B 'complianc':145C 'contain':108C 'credenti':93B 'cve':20A,23A 'cvss':94B 'discontinu':183C 'dns':67B 'endpoint':54B 'engin':9A 'ensur':144C,203C 'evalu':196C 'exploit':35B,98B 'exposur':201C 'follow':173C 'forens':166C 'forgeri':114C 'github':97B 'guard':60B 'guidanc':162C,178C 'guidelin':210C 'host':43B 'http':64B 'iam':92B 'id':52B 'instruct':143C 'intern':78B,122C 'internet':200C 'kev':106B 'languag':14A 'larg':13A 'learn':18A 'lfproject':1A 'lfprojects':29A 'list':103B 'machin':17A 'metadata':75B,125C 'mitig':138C,189C 'mlflow':2A,3A,26A,27A,28A,30A,36B,45B,107C 'model':15A,19A 'note':161C,172C 'open':6A 'patch':209C 'platform':10A 'poc':38B 'poc-publ':37B 'post':50B 'priorit':152C 'product':187C 'public':39B 'python':40B 'reach':73B,121C 'read':81B 'rebind':68B 'receiv':128C 'redirect':65B 'request':113C 'requir':135C,168C 'respons':83B,129C,132C,194C 'result':87B 'risk':157C 'secur':153C 'see':158C,169C 'self':42B 'self-host':41B 'server':47B,111C 'server-sid':110C 'servic':79B,126C,181C 'side':112C 'sourc':7A 'ssrf':44B,57B 'stakehold':192C 'status':130C 'theft':89B 'tool':33B 'track':46B 'triag':167C 'unauthent':49B 'unavail':191C 'updat':154C 'url':59B,159C,170C 'use':184C 'usual':86B 'vendor':142C 'vulner':115C 'wild':101B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-17T22:17:23+00:00","kev":{"dateAdded":"2026-08-19","dueDate":"2026-09-02","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-64849","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849","severity":null,"published_at":"2026-08-19T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-64849:18","url":null,"severity":null,"published_at":"2026-10-23T20:33:58+00:00","modified_at":"2026-10-23T20:33:58+00:00","first_seen_at":"2026-10-23T20:33:58+00:00","fetched_at":"2026-10-23T20:33:58+00:00","note":"Vendor GHSA-7gwp-5pfp-969j: affected >= 3.10.0, < 3.15.0, fixed in 3.15.0 (PR 24258). CISA KEV 2026-08-19; exploitation reported by CSA citing watchTowr/VulnCheck (secondary). No public PoC link found."},{"source":"nvd","external_id":"CVE-2026-64849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64849","severity":null,"published_at":"2026-08-17T22:17:23+00:00","modified_at":"2026-10-05T13:35:35+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"github-poc","external_id":"maxprog-svg/CVE-2026-64849","url":"https://github.com/maxprog-svg/CVE-2026-64849","severity":null,"published_at":"2026-10-25T09:15:33+00:00","modified_at":null,"first_seen_at":"2026-10-25T09:25:03+00:00","fetched_at":"2026-10-25T09:25:03+00:00","note":null}],"documents":[{"id":843,"url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","title":"GHSA-7gwp-5pfp-969j MLflow webhook SSRF","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":844,"url":"https://github.com/mlflow/mlflow/pull/24258","title":"Fix DNS-rebinding SSRF bypass in webhook delivery (PR 24258)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":845,"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-mlflow-ssrf-cve-2026-64849-20260826-csa-st/","title":"CSA: MLflow SSRF Actively Exploited for Cloud Credential Theft","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":3457,"url":"https://github.com/maxprog-svg/CVE-2026-64849","title":"maxprog-svg/CVE-2026-64849","kind":"poc","source":"github","text":"CVE-2026-64849 — MLflow SSRF\n\nstars 0","published_at":"2026-10-25T09:15:33+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}