MLflow · MLflow
The flaw is a server-side request forgery in the MLflow platform's webhook test functionality, where the webhook delivery component follows redirects and re-resolves hostnames after only the original URL has been validated. An attacker with network access can send an unauthenticated request to the webhook test endpoint, without any user interaction or special configuration, to make the server reach internal or cloud metadata services and return the response status and body to the attacker.
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
First seen exploited 1 day after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
7 fixes in mlflow over 7 months. The latest fix listed for mlflow is 3.17.0.
unauthenticated public-facing API endpoint exploited
the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint
SSRF proxies requests to internal services
allowing attackers to reach internal or cloud metadata services
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: mlflow.
Upgrade to 3.17.0 or later
Fixes this CVE and 10 other known vulnerabilities in this package (CVE-2023-1177, CVE-2023-3765, +8).
pip install "mlflow>=3.17.0"First fixed in 3.15.0 for CVE-2026-64849.
| If you run | Upgrade to |
|---|---|
| All versions before 3.15.0 | 3.17.0first fix for this CVE: 3.15.0 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.