CVE-2026-64849: SSRF Flaw in MLflow Actively Exploited

CVE-2026-64849 (CVSS 9.3, EPSS ≥ 95th pctl) is a critical-severity unauthenticated full-read server-side request forgery (SSRF) flaw [CWE-918] in MLflow webhook delivery. The CVE affects all versions prior to 3.15.0. The root cause is flawed redirect handling and DNS rebinding. The flaw is exploited by bypassing the _validate_webhook_url protections in the default MLflow Tracking Server configuration. CISA has added CVE-2026-64849 to the Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. The vendor’s advisory includes a detailed technical write-up and a proof-of-concept (PoC) exploit workflow. Additional technical analysis and PoC exploits are also available [1][2]. Multiple national CERT agencies worldwide have issued alerts [3][4][5][6][7][8][9].

A Risk Assessment of CVE-2026-64849 in MLflow

CVSS 9.3 · CriticalEPSS 8.2% (95th)Actively exploitedIn CISA KEVPublic PoC

MLflow is one of the most widely adopted self-hosted platforms for machine-learning experiment tracking and ML model lifecycle management. Organizations running MLflow should prioritize remediation because the flaw is being actively exploited, requires no authentication, and can expose internal service responses and cloud metadata through the webhook delivery path.

CISA added CVE-2026-64849 to its KEV catalog on August 19th, 2026. The vendor’s advisory itself includes a detailed technical write up and a proof-of-concept (PoC) exploit workflow. Additional technical analysis and PoC exploits are available [1][2]. These risk indicators support urgent remediation of exposed MLflow Tracking Server instances where webhook functionality is enabled for Model Registry or Prompt Registry events.

Technical Details for CVE-2026-64849 in MLflow

CVE-2026-64849 (CVSS 9.3, EPSS ≥ 95th pctl) is classified as an SSRF flaw [CWE-918]. The _validate_webhook_url function only validates the original webhook URL. However, the mlflow/webhooks/delivery.py execution follows HTTP redirects and re-resolves the hostname without pinning the previously validated address. The flaw exploits this flawed redirect handling and enables DNS rebinding attacks.

CVE-2026-64849 affects the MLflow Tracking Server, which may be reachable over the network without authentication by default in self-hosted deployments. The vulnerable path connects three components:

1. The attacker accesses the unauthenticated MLflow Tracking Server
2. The attacker invokes its exposed model-registry webhook API
3. The attacker abuses the API’s webhook testing workflow to trigger attacker-controlled requests to internal resources and return the response data to the attacker

Successful exploitation can compromise internal APIs and other services accessible to the MLflow host. The primary impact is information disclosure through unauthorized access to internal and cloud metadata services. This can include internal host and port discovery and, in cloud environments, exfiltration of credentials, API keys, tokens, or other secrets. Some public exploit variants can also preserve the original POST method and body, which may enable blind writes to private-network management endpoints. The official vendor advisory identifies the Docker daemon /stop, Elasticsearch /_close, and Spring Boot Actuator /shutdown endpoints.

Mitigation for CVE-2026-64849 in MLflow

MLflow 3.15.0 is the patched release, and all earlier versions are vulnerable. Users should update to MLflow 3.15.0 for complete mitigation. The OPENVAS ENTERPRISE FEED includes detection for CVE-2026-64849 in MLflow, allowing defenders to identify unpatched instances in their IT environments. Security teams should identify affected systems and prioritize remediation for deployments that use the default MLflow Tracking Server and expose the webhooks API. More information can be found in the MLflow GitHub advisory for CVE-2026-64849.

Summary

CVE-2026-64849 is a critical MLflow SSRF vulnerability affecting all versions prior to 3.15.0. The flaw is being actively exploited, and a significant amount of technical information and PoC exploit code is publicly available [1][2][3]. The operational risk is high because default MLflow Tracking Server deployments can expose the vulnerable webhook testing path without authentication. Multiple national CERT agencies worldwide have issued alerts [4][5][6][7][8][9][10]. Users should identify affected MLflow deployments and upgrade to version 3.15.0 for full mitigation.