CVE-2026-64849 -- CVSS 9.3 Vulnerability Briefing

CVE-2026-64849 | CVSS 9.3 (Critical) | Exploit: PoC available

What Is It

CVE-2026-64849 is a critical server-side request forgery vulnerability in MLflow webhook testing, affecting the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint in MLflow versions prior to 3.15.0.

Technical Detail

The endpoint validates only the original webhook URL through _validate_webhook_url(), but the webhook delivery logic follows redirects and resolves redirected hostnames again without binding the connection to the originally validated address. An attacker can provide a URL that redirects to an internal service or cloud metadata endpoint, causing the MLflow server to issue requests from its own network context. This can expose internal service reachability and response status information, and may enable access to cloud instance metadata or other services that trust the MLflow host.

Exploitation Status

A proof of concept is available. CISA has not listed this vulnerability in the Known Exploited Vulnerabilities catalog, and active exploitation in the wild has not been confirmed.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Upgrade MLflow to version 3.15.0 or later as a priority, particularly for deployments where the webhook test endpoint is reachable by untrusted users or networks. Until patched, restrict access to the MLflow API using authentication and network controls, and prevent the MLflow host from reaching cloud metadata addresses, loopback interfaces, private network ranges, and other sensitive internal services through egress filtering. Review MLflow and network logs for requests to /api/2.0/mlflow/webhooks/{id}/test, redirect chains, and outbound connections to metadata endpoints or unexpected internal addresses.