Executive brief
MLflow's model-registry webhook API is exposed without authentication on default deployments and can be abused to issue HTTP requests to arbitrary internal or cloud-metadata endpoints. An attacker bypasses the SSRF guard by pointing a webhook to their own legitimate HTTPS server, which responds with a redirect to a private IP address (like AWS metadata service or internal services). Because the webhook test endpoint reflects the response body, the attacker can read sensitive data such as cloud credentials or internal service responses.
Technical details
MLflow's webhook delivery system validates the initial webhook URL hostname (rejecting non-public IPs) but fails to re-validate redirect targets or pin the resolved IP address. The vulnerability combines three flaws: (1) webhook endpoints are unauthenticated by default (auth plugin is optional), (2) validation in _validate_webhook_url resolves the hostname but never carries the IP into the HTTP session, and (3) the delivery code follows HTTP redirects without re-validation. An attacker creates a webhook pointing to a legitimate HTTPS server under their control, which serves a 302 redirect to a private IP (e.g., 169.254.169.254/latest/meta-data or 127.0.0.1). The MLflow server follows the redirect and connects to the internal address. Because the POST /api/2.0/mlflow/webhooks/{id}/test endpoint reflects the response body to the caller, the attacker reads arbitrary internal HTTP responses. DNS rebinding can also be exploited: the initial validation resolves the hostname once, but the actual connection resolves independently with no IP pinning. The vulnerability is fixed in version 3.15.0 via PR #24258, which adds SSRFProtectedHTTPAdapter to validate the peer IP immediately after socket connection.
Affected products
- MLflow MLflow < 3.15.0
Timeline
- 2026-08-17: disclosed: CVE-2026-64849 published
- 2026-08-02: patched: Fixed in PR #24258 (commit ba94952247) / version 3.15.0
- 2026-06-26: exploited: Independently discovered and reported via issue #24179