CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Description
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
In plain language
AI Act nowMLflow lets anyone test a webhook by giving a URL, but an attacker can trick it into following redirects to internal/cloud services and pulling back sensitive data—so typical small businesses should treat this as urgent and upgrade to MLflow 3.15.0 or later.
In MLflow, the unauthenticated webhook delivery “test” feature bypasses webhook URL validation when the server follows HTTP redirects (and can also be affected by DNS rebinding), enabling SSRF to internal network resources and cloud metadata endpoints to read response contents.
What to do now
- Check your MLflow server version and whether the webhook test endpoint is reachable from untrusted networks.
- Upgrade MLflow to version 3.15.0 or later (preferably the latest patch release in your deployment line).
- If you cannot upgrade immediately, restrict network access so the MLflow web server (including the webhook test path) is not reachable from the internet.
- After upgrading, review webhook test/audit logs for requests that involved unusual redirect behavior or internal IP/domain targets.
pip install -U mlflow==3.15.0CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:CScopeC:HConfidentialityI:LIntegrityA:NAvailabilityWeaknesses
Affected Products
Exploitability
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
2 techniquesReferences
- MLflow Vulnerability Exploited for Cloud Credential Theften-us·SecurityWeek· Exploited MLflow cloud
- CISA warns of hackers exploiting critical MLflow vulnerabilityen-us·BleepingComputer· Exploited MLflow cloud
- Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secretsen·The Hacker News· Exploited MLflow ai-ml
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-64849 and every CVE in our database. Create a free account — no credit card required.
Create Free Account