CISA added CVE-2026-64849 to the Known Exploited Vulnerabilities catalog on August 19, 2026, confirming active exploitation of a critical (CVSS 9.3) unauthenticated server-side request forgery flaw in MLflow versions prior to 3.15.0.
What Is It
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to version 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL, while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address. The result is a classic TOCTOU redirect bypass of the URL allowlist, tracked as CWE-918 (Server-Side Request Forgery).
Why It Matters
An attacker can point the webhook test at an attacker-controlled host that redirects to an internal service or cloud metadata endpoint, and MLflow will return the response_status and response_body to them; turning a blind SSRF into a full read primitive against internal infrastructure.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, network reachable, no privileges, no user interaction, and scope changed, scoring 9.3 CRITICAL. CISA's SSVC assessment rates exploitation as active, automatable as yes, and technical impact as total. KEV lists known ransomware campaign use as "Unknown."
What's Vulnerable
- Product: MLflow (
cpe:2.3:a:lfprojects:mlflow) - Affected versions: all versions before 3.15.0
- Attack surface: the unauthenticated webhook test endpoint, reachable by anyone who can hit the MLflow tracking server over the network
Patch Status
Fixed in MLflow 3.15.0. The fix landed via PR #24258 (commit ba94952).
CISA's required action: apply mitigations in accordance with vendor instructions, ensuring compliance with BOD 26-04 "Prioritizing Security Updates Based on Risk" and CISA's "Forensics Triage Requirements." Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure. Due date: September 2, 2026.
Sources
- CISA KEV Catalog; CVE-2026-64849
- NVD, CVE-2026-64849
- GitHub Security Advisory GHSA-7gwp-5pfp-969j
- MLflow Issue #24179
- MLflow PR #24258 (patch)
- MLflow commit ba949522477cbd5915aa55d29b0cfad7d5ddf939
- MLflow v3.15.0 Release Notes
- CISA BOD 26-04
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements