CVE-2026-64849: MLflow unauthenticated SSRF via unvalidated webhook redirects

CVE-2026-64849 · Severity: critical · CVSS 9.3 · Exploited in the wild · Published 2026-08-17

MLflow's model-registry webhook API is exposed without authentication on default deployments and can be abused to issue HTTP requests to arbitrary internal or cloud-metadata endpoints. An attacker bypasses the SSRF guard by pointing a webhook to their own legitimate HTTPS server, which responds with a redirect to a private IP address (like AWS metadata service or internal services). Because the webhook test endpoint reflects the response body, the attacker can read sensitive data such as cloud credentials or internal service responses.

Technologies: mlflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-64849 exploited in the wild?
Yes. CVE-2026-64849 is known to be exploited in the wild, first recorded on 19 August 2026. Treat it as urgent.
How severe is CVE-2026-64849?
Critical severity, with a CVSS score of 9.3, published 17 August 2026.
Which products and versions are affected?
mlflow (PyPI) < 3.15.0, ECOSYSTEM:introduced=0,fixed=3.15.0.
Is there a fix for CVE-2026-64849?
Yes. mlflow (PyPI): upgrade to 3.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64849 attacked?
It is attacked over the network.
Am I affected by CVE-2026-64849?
Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mlflow (PyPI): upgrade to 3.15.0 or later
    pip install "mlflow>=3.15.0"

Technical details

MLflow's webhook delivery system validates the initial webhook URL hostname (rejecting non-public IPs) but fails to re-validate redirect targets or pin the resolved IP address. The vulnerability combines three flaws: (1) webhook endpoints are unauthenticated by default (auth plugin is optional), (2) validation in _validate_webhook_url resolves the hostname but never carries the IP into the HTTP session, and (3) the delivery code follows HTTP redirects without re-validation. An attacker creates a webhook pointing to a legitimate HTTPS server under their control, which serves a 302 redirect to a private IP (e.g., 169.254.169.254/latest/meta-data or 127.0.0.1). The MLflow server follows the redirect and connects to the internal address. Because the POST /api/2.0/mlflow/webhooks/{id}/test endpoint reflects the response body to the caller, the attacker reads arbitrary internal HTTP responses. DNS rebinding can also be exploited: the initial validation resolves the hostname once, but the actual connection resolves independently with no IP pinning. The vulnerability is fixed in version 3.15.0 via PR #24258, which adds SSRFProtectedHTTPAdapter to validate the peer IP immediately after socket connection.

Affected products

  • MLflow MLflow < 3.15.0

Identifiers

  • CVE-2026-64849
  • GHSA-7gwp-5pfp-969j
  • PYSEC-2026-3687

Timeline

  • 2026-08-17: disclosed: CVE-2026-64849 published
  • 2026-08-02: patched: Fixed in PR #24258 (commit ba94952247) / version 3.15.0
  • 2026-06-26: exploited: Independently discovered and reported via issue #24179

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.