MLflow SSRF leaks cloud metadata (CVE-2026-64849)

Actively exploited in the wild - CVE-2026-64849 is a critical server-side request forgery (SSRF) in MLflow prior to 3.15.0 that lets unauthenticated attackers reach internal services and cloud metadata endpoints via the webhook test API. Patched in version 3.15.0; upgrade immediately.

Overview

CVE-2026-64849 affects MLflow, the open source AI engineering platform used for managing machine learning models, large language models, and AI agents. The vulnerability resides in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint, which is used to test webhook configurations.

The core flaw is a validation bypass. When a user submits a webhook URL for testing, MLflow validates the address once via _validate_webhook_url() in mlflow/utils/validation.py. However, when the actual delivery happens in mlflow/webhooks/delivery.py, the system follows HTTP redirects and re-resolves the hostname without re-validating the final destination. This means an attacker can submit a URL that passes initial validation but redirects to an internal address.

An attacker can craft a webhook URL that redirects to internal network resources, such as cloud metadata services (for example, the AWS instance metadata service at 169.254.169.254) or other internal services. The response from these services, specifically response_status and response_body, is returned to the attacker.

The vulnerability carries a CVSS score of 9.3, rated critical, with an attack vector over the network, low attack complexity, no privileges required, and no user interaction needed. The EPSS score of 1.1% suggests a meaningful probability of exploitation within the next 30 days, and CISA has confirmed active exploitation.

Impact

Successful exploitation grants an unauthenticated attacker access to internal network resources that should be isolated. In cloud environments, this typically exposes instance metadata, which can include temporary security credentials, API keys, and configuration data. With these credentials, an attacker can escalate access to other cloud resources and services.

Beyond metadata theft, the SSRF can be used to scan internal networks, access internal administration panels, and reach services that are not intended to be publicly accessible.

Remediation

Upgrade MLflow to version 3.15.0 or later immediately. This version contains the fix that ensures the validated address is pinned and re-checked after any redirects.

For environments where an immediate upgrade is not possible, consider the following mitigations:

• Restrict network access to the MLflow server with firewall rules or security groups, limiting who can reach the webhook test endpoint.
• Place the MLflow instance behind a reverse proxy that can filter or inspect requests to the webhook test API.
• Monitor logs for unusual webhook test requests, particularly those with suspicious redirect chains or attempts to reach metadata service IP ranges.
• If MLflow is deployed with cloud IAM roles, rotate any credentials that may have been exposed during the exploitation window.

Security Insight

This vulnerability highlights a recurring pattern in SSRF flaws: validation logic that is applied at one point in the request lifecycle but not enforced at the point of actual execution. The redirect-following behavior in delivery code effectively undoes the security check performed during validation. This is the same class of issue seen in numerous cloud-native tools over the past several years, where developers secure the entry point but fail to account for intermediate steps in the request pipeline. For AI and ML platforms specifically, the rapid feature development pace often outpaces security hardening, making these tools increasingly attractive targets for attackers seeking to pivot into cloud environments.

For the latest updates on this and other actively exploited vulnerabilities, see our security news section. If your organization has been affected, our breach reports contain guidance on incident response and containment.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs