MLflow webhook bug can let attackers spy on your servers

Published August 17, 2026 CVE-2026-64849

MLflow's webhook feature has a critical flaw that lets attackers secretly check if your servers are online and see their responses. This can help them find and target your systems.

Severity
CriticalCVSS 3.1 · 9.3
Fix
Fixed in 3.15.0Fix recorded on Aug 26, 2026
Affected versions
before 3.15.0
Weakness
CWE-918Server-Side Request Forgery (SSRF)
Exploit likelihood
16% in 30 daysEPSS, higher than 97% of known flaws
Affects
MLflow
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 19, 2026
Federal fix deadline
Sep 2, 2026

How it works

An attacker sends a fake webhook request to MLflow's test endpoint, which lets them see if your server answers and what it returns, even if your server is not supposed to be reachable.

What to do

Check whether the installed MLflow version is older than 3.15.0.

Run this in the application environment you want to check:

python3 -m pip show mlflow

Update MLflow to 3.15.0 or newer. Then verify the installed version.

Technical details

A critical Server-Side Request Forgery (SSRF) vulnerability in MLflow's webhook delivery system (CVE-2026-64849) allows unauthenticated attackers to read arbitrary internal or external resources by bypassing the validate_webhook_url check. The flaw stems from improper validation of HTTP redirects and DNS rebinding in the /api/2.0/mlflow/webhooks/{id}/test endpoint, which returns the full upstream response, including sensitive data, without authentication. This affects the default MLflow Tracking Server (unauthenticated, SQLite backend) and could enable attackers to probe internal networks, exfiltrate data, or perform reconnaissance. No fixed version was disclosed in the source.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact Low Some data can be modified
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N Open in FIRST.org calculator

References

View Original Source