CVE-2026-64849

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.15.0

Description An unauthenticated Server-Side Request Forgery (SSRF) exists in the MLflow Tracking Server. The POST /api/2.0/mlflow/webhooks/{id}/test endpoint allows an attacker to make the server issue HTTP requests to arbitrary internal, loopback, or cloud-metadata endpoints and read the responses. While a validation function validate webhook url() is used to reject non-public IPs, it only checks the original URL and does not pin the validated address. An attacker can bypass this guard by hosting a public HTTPS endpoint that returns a 302 redirect to an internal target, which the server follows without re-validation. This can be used to steal cloud instance-metadata (such as AWS IMDS IAM credentials), access internal admin services, or perform internal port scanning. Additionally, 307 or 308 redirects can be used for blind write attacks against private-network management endpoints.

Recommendations Update MLflow to version 3.15.0 or later. As a temporary workaround, restrict network access to the MLflow Tracking Server to trusted sources only to prevent unauthenticated access to the webhooks API.