---
id: "CVE-2026-64849"
kind: "vulnerability"
aliases: ["CVE-2026-64849"]
title: "lfprojects mlflow: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models"
severity: "critical"
cvss: 9.3
epss: null
exploited: true
status: "open"
category: "ai-tooling"
products: [{"name": "MLflow MLflow", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "mlflow", "fixed": ["3.15.0"], "affected": ">= 3.10.0, < 3.15.0", "ecosystem": "pip"}, {"name": "lfprojects mlflow", "fixed": ["3.15.0"], "affected": ">= 3.3.0, < 3.15.0", "ecosystem": "vendor"}]
ecosystems: ["pip", "vendor"]
tags: ["ai-tooling", "cloud", "exploited", "mlflow", "poc-public", "python", "self-hosted", "ssrf"]
not_affected_if: ["auth-required", "managed-hosting", "no-mlflow-server"]
published_at: "2026-08-17T22:17:23+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-25T09:38:59+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:33:58+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64849", "first_seen_at": "2026-10-23T23:44:52+00:00"}, {"source": "github-poc", "url": "https://github.com/maxprog-svg/CVE-2026-64849", "first_seen_at": "2026-10-25T09:25:03+00:00"}]
---

# lfprojects mlflow: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models

MLflow Tracking Server's unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint is an SSRF. The URL guard is bypassed through HTTP redirects and DNS rebinding, so an attacker can reach cloud metadata (169.254.169.254) or internal services and read the response body. The usual result is theft of cloud IAM credentials. CVSS 9.3 (CNA GitHub). Exploited in the wild and listed in CISA KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MLflow MLflow affected ? fixed ?
- pip:mlflow affected >= 3.10.0, < 3.15.0 fixed 3.15.0
- vendor:lfprojects mlflow affected >= 3.3.0, < 3.15.0 fixed 3.15.0

## How to check

Run 'pip show mlflow' (or 'mlflow --version') on each host or container image running 'mlflow server'. Versions >= 3.10.0 and < 3.15.0 are vulnerable. Check whether the server is reachable without authentication. Review registry webhooks for unknown URLs. Check cloud audit logs (CloudTrail etc.) for use of the host's IAM role from unfamiliar IPs.

## Fix

Upgrade mlflow to 3.15.0 or later (pip install -U 'mlflow>=3.15.0'). If you can't patch yet, block egress from the server to 169.254.169.254, enforce IMDSv2, and put the server behind authentication or a VPN. If it was exposed while unpatched, rotate the credentials of the host's IAM role, managed identity or service account.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849
- 2026-10-23T20:33:58+00:00 analyst — Vendor GHSA-7gwp-5pfp-969j: affected >= 3.10.0, < 3.15.0, fixed in 3.15.0 (PR 24258). CISA KEV 2026-08-19; exploitation reported by CSA citing watchTowr/VulnCheck (secondary). No public PoC link found.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64849
- 2026-10-25T09:25:03+00:00 github-poc https://github.com/maxprog-svg/CVE-2026-64849

## Documents

- [advisory] GHSA-7gwp-5pfp-969j MLflow webhook SSRF https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
- [discussion] CSA: MLflow SSRF Actively Exploited for Cloud Credential Theft https://labs.cloudsecurityalliance.org/research/csa-research-note-mlflow-ssrf-cve-2026-64849-20260826-csa-st/
- [fix] Fix DNS-rebinding SSRF bypass in webhook delivery (PR 24258) https://github.com/mlflow/mlflow/pull/24258
- [poc] maxprog-svg/CVE-2026-64849 https://github.com/maxprog-svg/CVE-2026-64849

## From the sources

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_