CVE-2026-64849: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls validatewebhookurl() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive responsestatus and responsebody. This issue is fixed in version 3.15.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MLflowto a version that resolves this vulnerability.Fixed in 3.15.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64849?
CVE-2026-64849 has a critical severity score of 9.3.
How do I fix CVE-2026-64849?
To fix CVE-2026-64849, upgrade MLflow to version 3.15.0 or later.
What type of vulnerability is CVE-2026-64849?
CVE-2026-64849 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What is affected by CVE-2026-64849?
The vulnerability affects the MLflow open source AI engineering platform prior to version 3.15.0.
What are the potential impacts of CVE-2026-64849?
CVE-2026-64849 can allow unauthenticated users to exploit the system via unvalidated HTTP redirects.