Skip to content
Fencer Intel
critical 9.3

CVE-2026-64849 kev in the critical feed json

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

published 3mo ago modified 16d ago also BIT-mlflow-2026-64849 , EUVD-2026-60473 , GHSA-7gwp-5pfp-969j , PYSEC-2026-3687

cvss
9.3
version 3.1, CNA
cisa kev
Exploited
added 2026-08-19
epss
10.0%
EPSS 10.0% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

Patch / fix

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

  • pypi mlflow 3.15.0
  • bitnami mlflow 3.15.0
  • lfprojects mlflow 3.15.0

Is CVE-2026-64849 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-64849 updated cvss 8.5

mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

  • Red Hat OpenShift AI 3.4 rhoai/odh-mlflow-rhel9 1787226790
    fixed: vendor fix RHSA-2026:60520
  • Red Hat OpenShift AI 3.5 rhoai/odh-latency-predictor-training-rhel9 1786552250, rhoai/odh-latency-predictor-prediction-rhel9 1786552271
    fixed: vendor fix RHSA-2026:60367
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-th06-cpu-torch210-py312-rhel9, rhoai/odh-th06-rocm64-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch210-py312-rhel9, rhoai/odh-training-cuda128-torch29-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9, +12 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1787330837, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-autorag-rhel9 1786612637, rhoai/odh-trainer-rhel9 1787089049, rhoai/odh-eval-hub-rhel9 1787087463, +99 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA SSVC: exploitation active
  4. CISA patch deadline

Known exploited

Added
2mo ago
Patch by
2026-09-02 (2mo ago)
Ransomware
Not known
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor, product
MLflow, MLflow
CISA name
MLflow Server-Side Request Forgery Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
partial
Assessed
2mo ago

Exploit prediction

10.02% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • github.com https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/mlflow/mlflow/issues/24179 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
GitHub 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
OSV 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi mlflow
>=3.3.0, <3.15.0
<3.15.0
3.15.0
bitnami mlflow
>=3.3.0, <3.15.0
3.15.0

Affected products

  • mlflow mlflow

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of mlflow/mlflow published their own advisory on GitHub. Reviewed sources take precedence over it.