CVE-2026-64849: MLflow Webhook SSRF to Cloud Metadata (KEV)

CVE-2026-64849 is a server-side request forgery in MLflow's webhook-test endpoint that lets an unauthenticated attacker make the MLflow tracking server fetch internal or cloud metadata URLs and read the response back through the API, by redirecting past MLflow's own private-IP guard.

CVE-2026-64849 is a server-side request forgery (CWE-918) in MLflow, the open-source machine-learning and LLM-agent tracking platform. NVD's Analyzed description states that on a default MLflow Tracking Server the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint "calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body" (NVD).

NVD's vulnStatus for this record is Analyzed, but NVD has not published its own independent Primary CVSS score; the only metric on record is the reporting GitHub Security Lab researcher's Secondary CVSS v3.1 rating of 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N). So the 9.3 shown here is the GHSA Secondary score, not an NVD-confirmed Primary score (NVD).

The GitHub Security Advisory (published 2026-08-02) explains the webhook endpoints are unauthenticated by default (the optional auth plugin is not loaded unless configured), and that the SSRF guard added in an earlier PR "resolves the webhook hostname and rejects non-public IPs, but it is bypassable: delivery follows HTTP redirects (no allow_redirects=False) and never pins the validated IP." An attacker hosts a public HTTPS endpoint that passes the guard, then returns a 302 Location: http://169.254.169.254/... redirect; MLflow follows it and reflects the response body back through /test, giving an "unauthenticated full-read SSRF on a default server" that can reach cloud instance-metadata endpoints or localhost services (GitHub Advisory GHSA-7gwp-5pfp-969j).

CISA added CVE-2026-64849 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-19, with a required-action due date of 2026-09-02; the catalog does not record known ransomware campaign use (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.1002 (95.598th percentile) (FIRST EPSS).

Any MLflow Tracking Server reachable by untrusted clients should be upgraded to 3.15.0 or later immediately; because the flaw can leak cloud credentials via instance metadata, teams running affected versions on AWS/GCP/Azure should also rotate any credentials reachable from the tracking server's network and audit webhook configuration history for signs of abuse.

• The unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint validates only the original webhook URL, but delivery follows redirects without re-validating them, letting an attacker reach internal or cloud metadata services and read the response. — NVD
• CVSS v3.1 base score is 9.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N — the reporting researcher's GHSA Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
• Webhook endpoints are unauthenticated by default; the SSRF guard checks only the original URL and does not pin the validated IP, so a 302 redirect to an internal/metadata address bypasses it; fixed in MLflow 3.15.0. — GitHub Advisory GHSA-7gwp-5pfp-969j
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-19, required-action due date 2026-09-02. — CISA KEV
• EPSS score is 0.1002 (95.598th percentile) as of 2026-10-28. — FIRST EPSS