CVE-2026-64849Critical· 9.3▾ Hadal⚠ Exploited in the wildPoC availableMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_…
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 51.2 · likelihood 2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Federal remediation due Sep 2, 2026
0.3% → 16%
5 GitHub repos · Nuclei ×1
9.3 → 8.5
critical → high
8.5 → 9.3
high → critical
Last analysed / modified upstream
Added to the CISA catalog on Aug 19, 2026. Federal remediation due Sep 2, 2026. View catalog ↗
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
mlflow >= 3.3.0, < 3.15.0Upgrade past the affected range:
mlflow 3.15.0Affected packages:
mlflow >= 3.3.0, < 3.15.0Patched in:
mlflow 3.15.0Source: https://github.com/advisories/GHSA-7gwp-5pfp-969j
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-71211High· 7.1MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim
CVE-2026-115886Medium· 6.5MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
CVE-2026-53995High· 8.2MLflow 3.17.1 and prior Path Traversal via Trace ID API
CVE-2026-2611Critical· 9.6In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints
CVE-2026-69146Medium· 6.5MLflow is an open source AI engineering platform for agents, large language models, and machine learning models
CVE-2026-69148High· 7.1MLflow is an open source AI engineering platform for agents, large language models, and machine learning models