MLflow webhook test SSRF allows unauthenticated access to internal and cloud metadata (CVE-2026-64849)

What happened

MLflow versions before 3.15.0 contain an unauthenticated server-side request forgery (SSRF) weakness in the POST /api/2.0/mlflow/webhooks/{id}/test endpoint. When a webhook is tested, MLflow validates the original URL, but the delivery step follows HTTP redirects and re-resolves the hostname without pinning the validated address. An attacker can point the webhook at a URL that passes validation and then redirects to internal services or cloud metadata endpoints. The response_status and response_body are then returned, which can expose data from services the MLflow server can reach.

The CVSS v3.1 score is 9.3 (Critical). The vector is network-reachable, low complexity, no privileges, no user interaction, changed scope, high confidentiality impact and low integrity impact. CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2026-08-19, with a due date of 2026-09-02. CISA KEV and CISA SSVC record active exploitation. The record does not include a separate vendor advisory.

Who is affected

MLflow before 3.15.0 is affected. MLflow is an open source AI engineering platform for agents, large language models and machine learning models. Affected deployments are those where the unauthenticated webhook testing endpoint is reachable by an attacker. If you run MLflow in a cloud or shared environment, treat this as relevant until you confirm you are on 3.15.0.

What to do now

1. Upgrade to MLflow 3.15.0, the fixed version identified in the record.
2. If an immediate upgrade is not possible, restrict network access to the MLflow server and the webhook testing endpoint so that untrusted networks cannot reach it.
3. Check whether the affected endpoint has been exposed to the internet or untrusted networks. CISA added this CVE to KEV on 2026-08-19 with a due date of 2026-09-02; organisations following BOD 26-04 should treat the deadline as passed.
4. Review webhook delivery logs and outbound traffic from MLflow for signs of exploitation, as described under detection hints.

No vendor workaround is listed in this record.

How to detect it

No vendor-supplied indicators of compromise are provided in the source record. Based on the technical effect, review MLflow webhook delivery logs for unexpected redirects, unusual outbound destinations in internal address ranges, or connections to cloud metadata endpoints. Also review access to the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint from unexpected source addresses. These checks help identify exposure, but they are not a substitute for the fixed version.

Beyond the patch

This is an unauthenticated, network-reachable SSRF with active exploitation recorded by CISA. Patching is the first step, but the next step is to assume the MLflow server may have been used to reach internal services or cloud metadata and to look for what followed. Managed Detection & Response (MDR) can help detect and respond to that post-exploitation activity, and Virtual CISO Services (vCISO) can help assess internet-exposed MLflow or ML infrastructure before the next issue reaches the same level.