CVE-2026-64849: MLflow SSRF Webhook Bypass Actively Exploited

A critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability has been disclosed in MLflow's webhook delivery system. Tracked as CVE-2026-64849 with a CVSS score of 9.3, the flaw allows attackers to redirect server-side requests to internal resources — including AWS instance metadata endpoints — and exfiltrate IAM credentials and other sensitive cloud secrets without any authentication.

Active exploitation was confirmed within hours of the CVE being assigned on August 17, 2026, with watchTowr reporting mass scanning of internet-exposed MLflow tracking servers.

What Is Affected

All MLflow versions before 3.15.0 are vulnerable. This includes versions 3.10.0 through 3.14.x, which introduced an earlier mitigation attempt (PR #20747) that this bypass defeats. Unpatched versions of MLflow 2.x are also affected.

Many production MLflow deployments run with authentication disabled by default, significantly widening the potential attack surface.

Technical Details

The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) flaw in MLflow's webhook URL validation:

1. Registration time — _validate_webhook_url() checks that the supplied webhook URL resolves to a public IP address. The check passes.

2. Delivery time — When MLflow delivers a webhook event, it uses the requests library with redirect-following enabled (allow_redirects defaults to True). The delivery layer never re-validates redirect targets.

3. Exploitation — An attacker registers a webhook pointing to an attacker-controlled public HTTPS endpoint. When MLflow fires the webhook, the public server responds with a 302 redirect to an internal address such as:

   • http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDS)
   • http://127.0.0.1:<port>/ (local service)
   • Any RFC1918 internal host

4. Data reflection — MLflow's /test endpoint reflects the full HTTP response body from the redirected request back to the caller, making this a full-read SSRF.

A secondary exploitation path via DNS rebinding also exists through the same validation gap.

GitHub Advisory: GHSA-7gwp-5pfp-969j CWE: CWE-918 (Server-Side Request Forgery) EPSS: 27.93%

Impact

A successful exploit can result in:

• Cloud credential theft — AWS IAM keys, GCP service account tokens, and Azure MSI tokens extracted from instance metadata endpoints
• Internal network reconnaissance — port scanning and service enumeration of internal infrastructure
• Secret exfiltration — application configs, internal API keys, and environment variables from internal-only services

Because many MLflow deployments are hosted in cloud environments with access to rich metadata services, the real-world impact of this class of vulnerability is especially severe.

Exploitation Activity

Security firm watchTowr detected widespread scanning of internet-exposed MLflow instances within hours of the CVE being publicly assigned on August 17, 2026. Miggo Research, which originally reported the flaw, confirmed the bypass technique on August 12, 2026.

The vulnerability was originally discovered and privately reported by @freeman-bb on June 12, 2026, and independently found by @AUTHENSOR, who filed it publicly on June 26, 2026.

Remediation

Immediate: Upgrade MLflow

Upgrade to MLflow 3.15.0 or later. The fix (PR #24258) modifies the webhook delivery layer to disable redirect-following and re-validate the final request target before sending.

pip install --upgrade mlflow

Interim Mitigations (if upgrade is not immediately possible)

1. Enable authentication on the MLflow tracking server. This requires a valid session to register webhooks.
2. Restrict network egress — block outbound connections from the MLflow server to RFC1918 ranges, loopback (127.0.0.1/8), and link-local (169.254.0.0/16) addresses at the firewall or security group level.
3. Disable the webhook feature if your deployment does not use it.
4. Remove public internet exposure — if MLflow does not need to be internet-accessible, restrict access to internal networks or VPN only.

Detection

Look for webhook registrations pointing to external domains followed by redirects to internal IP ranges in your MLflow server logs. Any requests to 169.254.169.254 originating from the tracking server should be treated as an active exploitation attempt.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References

• NVD — CVE-2026-64849
• GitHub Security Advisory GHSA-7gwp-5pfp-969j
• MLflow 3.15.0 Release Notes
• Miggo Research — CVE-2026-64849 Write-up