9.3
Critical
CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns
Not observed so far
Weakness
CWE-918
Description
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MLflow 3.3 | 3.3.0 → < 3.15.0 | 3.15.0 |
Other CVEs of MLflow
The 38 CVEs of MLflow →
CVE-2026-118628
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
8.2
High
CVE-2026-118627
MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
7.8
High
CVE-2026-118626
MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability
5.4
Medium
CVE-2026-118625
MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability
6.3
Medium