{"id":"CVE-2026-64849","title":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models","summary":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cwe":["CWE-918"],"vendor":"lfprojects","product":"mlflow","affected":["mlflow >= 3.3.0, < 3.15.0"],"patched":["mlflow 3.15.0"],"published":"2026-08-17","updated":"2026-10-05","sourceUpdated":"2026-10-05T13:35:35.850","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64849","references":[{"url":"https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939","label":"security-advisories@github.com"},{"url":"https://github.com/mlflow/mlflow/issues/24179","label":"security-advisories@github.com"},{"url":"https://github.com/mlflow/mlflow/pull/24258","label":"security-advisories@github.com"},{"url":"https://github.com/mlflow/mlflow/releases/tag/v3.15.0","label":"security-advisories@github.com"},{"url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","label":"security-advisories@github.com"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64849"},{"url":"https://github.com/advisories/GHSA-7gwp-5pfp-969j"},{"url":"https://github.com/mlflow/mlflow"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-3687.yaml"},{"url":"https://pypi.org/project/mlflow"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64849.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64849"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517655"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64849"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"url":"https://access.redhat.com/errata/RHSA-2026:60367"}],"tags":["nvd","kev","in-the-wild","exploit-available","ghsa","pip","cve.org","csaf","vex","red-hat","osv"],"epss":0.10017,"epssPercentile":0.95589,"kev":true,"kevDateAdded":"2026-08-19","kevDueDate":"2026-09-02","kevRansomware":false,"exploited":true,"exploits":{"github":5,"githubRepos":["https://github.com/codeb0ssx/CVE-2026-64849-PoC","https://github.com/BiuTrap/CVE-2026-64849","https://github.com/zavisco/CVE-2026-64849.yaml"],"nuclei":["CVE-2026-64849"],"checkedAt":"2026-10-27T19:07:31.089Z"},"exploitAvailable":true,"aliases":["GHSA-7gwp-5pfp-969j","BIT-mlflow-2026-64849","PYSEC-2026-3687"],"ecosystem":"pip","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-20T03:55:29.820245Z"},"scores":{"nvd":9.3,"ghsa":9.3,"cna":9.3,"vendor":8.5,"osv":9.3},"ingestedAt":"2026-08-17T22:01:16.670Z","slug":"CVE-2026-64849","body":"## Overview\n\nMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.\n\n## Affected\n\n- `mlflow >= 3.3.0, < 3.15.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `mlflow 3.15.0`\n\n## Package advisory (CVE-2026-64849)\n\nAffected packages:\n\n- `mlflow >= 3.3.0, < 3.15.0`\n\nPatched in:\n\n- `mlflow 3.15.0`\n\nSource: https://github.com/advisories/GHSA-7gwp-5pfp-969j\n\n## Vendor advisories\n\n- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)\n- **RHSA-2026:60367** · Red Hat · fixed in: Red Hat OpenShift AI 3.5 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60367)","depth":"hadal","depthScore":78,"depthScoreParts":{"impact":51.2,"likelihood":2,"exploitation":25,"ransomware":0},"changes":[{"seq":214617,"id":"CVE-2026-64849","ts":1790881128428,"field":"cvss","old":"8.5","new":"9.3"},{"seq":214616,"id":"CVE-2026-64849","ts":1790881128428,"field":"severity","old":"high","new":"critical"},{"seq":210785,"id":"CVE-2026-64849","ts":1790326128252,"field":"epss","old":"0.1641","new":"0.09839"},{"seq":208487,"id":"CVE-2026-64849","ts":1790005717890,"field":"cvss","old":"9.3","new":"8.5"},{"seq":208486,"id":"CVE-2026-64849","ts":1790005717890,"field":"severity","old":"critical","new":"high"},{"seq":5403,"id":"CVE-2026-64849","ts":1788887280631,"field":"exploit_available","old":"false","new":"true"},{"seq":4286,"id":"CVE-2026-64849","ts":1788886394666,"field":"exploit_available","old":"true","new":"false"},{"seq":3035,"id":"CVE-2026-64849","ts":1788883057966,"field":"exploit_available","old":"false","new":"true"},{"seq":2064,"id":"CVE-2026-64849","ts":1788882463140,"field":"exploit_available","old":"true","new":"false"},{"seq":1137,"id":"CVE-2026-64849","ts":1788881899545,"field":"exploit_available","old":"false","new":"true"},{"seq":183,"id":"CVE-2026-64849","ts":1787603679173,"field":"epss","old":"0.08154","new":"0.1641"},{"seq":156,"id":"CVE-2026-64849","ts":1787257348774,"field":"epss","old":"0.01109","new":"0.08154"},{"seq":138,"id":"CVE-2026-64849","ts":1787170773111,"field":"exploited","old":"false","new":"true"},{"seq":137,"id":"CVE-2026-64849","ts":1787170773111,"field":"kev","old":"false","new":"true"}]}