MLflow Server-Side Request Forgery Vulnerability (CVE-2026-64849)

What is affected, what to do

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body.

The vulnerability is being actively exploited; treat it as a priority. Update mlflow to version 3.15.0. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• MLflow gte 3.3.0, < 3.15.0..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade MLflow to 3.15.0 or later. All versions from 3.3.0 up to (but excluding) 3.15.0 are affected. Inventory with pip show mlflow and container image scans. Include notebooks, CI runners and Docker images that embed a tracking server, not just the central instance.
   • Handle the Oracle Communications products separately. Affected are Unified Assurance 7.0.0, Cloud Native Core SEPP 25.2.201 and 26.1.200, Service Catalog and Design 8.0-8.3, and Operations Monitor 6.1. Patch available from the vendor — look up the version in the vendor advisory (Oracle Critical Patch Update). Apply the compensating controls below until it is deployed.
   • Block POST /api/2.0/mlflow/webhooks/{id}/test immediately. Return HTTP 403 at the reverse proxy or ingress (nginx, Traefik, ALB) until patched. The endpoint requires no authentication.
   • Pull internet-exposed MLflow instances off the internet. These typically run on the default port 5000/tcp. Restrict access to management networks or VPN, and check your attack-surface monitoring or Shodan for exposed instances.
   • Rotate the cloud credentials of the MLflow host. This applies if it runs on AWS, Azure or GCP with an instance role or managed identity and the endpoint was reachable. Temporary credentials may have been pulled via the metadata service. Also review artifact store keys (S3, Azure Blob, GCS) and backend store database credentials.
   • Inventory existing webhooks. List them with GET /api/2.0/mlflow/webhooks/list and delete any webhook with an unknown or undocumented target URL.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation / egress filtering: Allowlist outbound traffic from the MLflow server to required destinations only (artifact store, backend DB, legitimate webhook receivers). Explicitly deny 169.254.169.254/32, fd00:ec2::254, metadata.google.internal, and RFC1918 ranges not needed by the service.
   • Metadata service hardening: On AWS, enforce IMDSv2 (HttpTokens=required, HttpPutResponseHopLimit=1) so an SSRF GET cannot obtain a session token. On Kubernetes, block metadata access via NetworkPolicy, or use workload identity instead of node credentials.
   • WAF / reverse proxy: Add a rule matching POST requests to ^/api/2\.0/mlflow/webhooks/[^/]+/test$ that blocks or logs them. Only allow webhook creation (POST /api/2.0/mlflow/webhooks) and updates from admin source networks.
   • IAM / least privilege: Run MLflow with authentication, either the built-in basic-auth app (--app-name basic-auth) or an OIDC proxy in front. Verify that the webhook routes are actually covered. Scope the host's instance role down so stolen credentials have limited blast radius.
   • Configuration / DNS: Enable DNS rebinding protection on internal resolvers (e.g. private-address in Unbound, stop-dns-rebind in dnsmasq) so external names cannot resolve to private or link-local addresses.
3. 03

   Runbook step 3

   Detection rules

   • Web server / proxy access logs: Look for POSTs to the webhook test endpoint, especially from non-admin sources. Splunk: index=web uri_path="/api/2.0/mlflow/webhooks/*/test" http_method=POST | stats count by src_ip, uri_path. A webhook created (POST /api/2.0/mlflow/webhooks) shortly before by the same source IP is a strong signal.
   • Network telemetry (Zeek/Suricata): Watch for connections from MLflow hosts to 169.254.169.254 or internal admin services. Suricata sketch: alert http $MLFLOW_HOSTS any -> 169.254.169.254 80 (msg:"MLflow host IMDS access"; http.uri; content:"/latest/meta-data"; sid:...;). In Zeek http.log, look for 3xx responses from external targets followed by requests to RFC1918 or link-local addresses.
   • DNS logs: Flag resolutions of rebinding domains (*.nip.io, *.sslip.io, *.rbndr.us) by MLflow hosts, or external names resolving to private IPs. Sigma shape: logsource: dns, query|endswith: ['.nip.io','.rbndr.us','.sslip.io'], filtered to MLflow hosts.
   • Cloud audit: Detect instance-role credentials used from IPs outside your environment, e.g. the GuardDuty finding UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS, CloudTrail source-IP anomalies, or Azure managed-identity sign-in logs.
   • EDR: Monitor the Python process (mlflow server, gunicorn, uvicorn) for unexpected outbound connections to internal management ports such as 2375, 6443, 8500 or 9200.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

Source: BSI CSAF, BSI WID Portal, pwn.watch, GitHub Security Advisories, NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE), redhat_csaf

Vendors and products

• MLflow MLflow
• MLflow MLflow
• Open Source Mlflow
• Oracle Communications

Weakness classes (CWE)

• CWE-918Server-Side Request Forgery (SSRF)

  Base

  The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

  Entry at MITRE CWE-918

References & sources

• github.commlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969jx_refsource_CONFIRM, Exploit, Vendor advisory
• github.commlflow/mlflow/issues/24179x_refsource_MISC, Exploit, Issue tracking, Mitigation
• github.commlflow/mlflow/pull/24258x_refsource_MISC, pwn-watch, Issue tracking, Patch
• github.commlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939x_refsource_MISC, Patch
• github.commlflow/mlflow/releases/tag/v3.15.0x_refsource_MISC, Release notes
• github.commlflow/mlflowpackage
• pypi.orgproject/mlflowpackage
• GitHub Security Advisoriesadvisories/GHSA-7gwp-5pfp-969jadvisory
• NVD (NIST)NVD: CVE-2026-64849advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849government-resource, US government resource
• github.compypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-3687.y…web
• pwn.watchpwn.watch: MLflow MLflow: MLflow Server-Side Request Forgery Vulnerabilitypwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 05.10.2026NVD analysis modifiedNVD

   Product mapping changed:

   • MLflow (3.3.0 – before 3.15.0)
   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	changed	OR *cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* versions up to (excluding) 3.15.0	OR *cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* versions from (including) 3.3.0 up to (excluding) 3.15.0

   Source identifier: nvd@nist.gov

2. 02.10.2026Record modifiedGitHub

   Description added or changed

   New references:

   • https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939
   • https://github.com/mlflow/mlflow/issues/24179
   • https://github.com/mlflow/mlflow/pull/24258
   • https://github.com/mlflow/mlflow/releases/tag/v3.15.0

   and 1 more reference

   Show 17 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Description	changed	MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.	MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
   Affected versions (publisher)	added	—	Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/64xxx/CVE-2026-64849.json">CVE-2026-64849</a>
   Reference	added	—	https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939
   Reference	added	—	https://github.com/mlflow/mlflow/issues/24179
   Reference	added	—	https://github.com/mlflow/mlflow/pull/24258
   Reference	added	—	https://github.com/mlflow/mlflow/releases/tag/v3.15.0
   Reference	added	—	https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
   Reference	removed	https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939	—
   Reference	removed	https://github.com/mlflow/mlflow/issues/24179	—
   Reference	removed	https://github.com/mlflow/mlflow/pull/24258	—
   Reference	removed	https://github.com/mlflow/mlflow/releases/tag/v3.15.0	—
   Reference	removed	https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j	—
   Reference type	removed	https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939 Types: Patch	—
   Reference type	removed	https://github.com/mlflow/mlflow/issues/24179 Types: Exploit, Issue Tracking, Mitigation	—
   Reference type	removed	https://github.com/mlflow/mlflow/pull/24258 Types: Issue Tracking, Patch	—
   Reference type	removed	https://github.com/mlflow/mlflow/releases/tag/v3.15.0 Types: Release Notes	—
   Reference type	removed	https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j Types: Exploit, Vendor Advisory	—

   Source identifier: security-advisories@github.com

3. 02.10.2026Record modifiedCISA ADP

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849
   Reference	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849	—
   Reference type	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849 Types: US Government Resource	—

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 20.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-64849","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-19T17:44:03.944227Z"}	{"id":"CVE-2026-64849","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-08-18T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 19.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849
   SSVC assessment	changed	{"id":"CVE-2026-64849","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-18T00:00:00+00:00"}	{"id":"CVE-2026-64849","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-19T17:44:03.944227Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

One NVD translation into another language is hidden.

Linked advisories

• @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33SANS @RISK27.08.2026