Case mlflow-cve-2026-64849-kevAI supply chainWorldwide
CISA lists MLflow webhook SSRF (CVE-2026-64849) reaching cloud metadata as exploited
An unauthenticated webhook test endpoint in MLflow validated only the initial URL, then followed redirects and re-resolved hostnames, letting attackers reach internal and cloud metadata services and read the response; CISA flagged active exploitation.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 19, 2026
- Location
- Worldwide
- Target
- MLflow tracking servers 3.3.0 to 3.14.x
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- CVE-2026-64849
What happened
An unauthenticated webhook test endpoint in MLflow validated only the initial URL, then followed redirects and re-resolved hostnames, letting attackers reach internal and cloud metadata services and read the response; CISA flagged active exploitation.
Impact: Unauthenticated access to internal services and cloud instance metadata from exposed MLflow servers; scale of exploitation not disclosed
Who triggered it
Actor: Unknown
Attribution: CISA recorded exploitation as active two days after publication; no public attribution
Motive: Unknown; SSRF to metadata services typically yields cloud credentials
How it happened
Attack vector: POST /api/2.0/mlflow/webhooks/{id}/test with a URL that redirects to internal or metadata addresses
Root cause: URL validation not pinned to the resolved address and redirects followed during webhook delivery
Timeline
- CVE-2026-64849 published; fixed in MLflow 3.15.0
- CISA adds the CVE to the KEV catalog
Response
Upgrade to MLflow 3.15.0; restrict network access to tracking servers
Current status: Patched
Sources (open in a new tab)
- CISA KEV cisa.gov
- MLflow advisory github.com
Cite this case
CISA lists MLflow webhook SSRF (CVE-2026-64849) reaching cloud metadata as exploited. AI Threat Watch, case mlflow-cve-2026-64849-kev, Aug 19, 2026. https://aithreat.io/cases/mlflow-cve-2026-64849-kev/
Permanent link: https://aithreat.io/cases/mlflow-cve-2026-64849-kev/