CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
Overview
MLflow's webhook test endpoint contains a server-side request forgery flaw that allows an unauthenticated attacker to read the HTTP response body from internal services or cloud metadata endpoints reachable by the MLflow server. The flaw affects all MLflow versions before 3.15.0 running in the default configuration, which exposes the webhook API without authentication. In cloud-hosted deployments, an attacker can extract instance metadata credentials, making this a direct path to cloud account compromise.
Vulnerability details
MLflow's SSRF guard, introduced in version 3.10.0, validates a webhook URL by resolving its hostname and rejecting non-public IP addresses. The guard operates only on the original URL supplied at registration or test time. When the HTTP client in the delivery layer follows a 302 redirect, it re-resolves the redirect target independently and without re-running the validation. The resolved IP from the guard is never pinned to the connection, so the guard's decision and the actual connection destination can diverge completely. This is a classic TOCTOU pattern within the SSRF weakness class: the check and the use operate on different values.
An attacker sends two unauthenticated POST requests to a default MLflow server. The first creates a webhook pointing to an attacker-controlled public HTTPS host with a valid certificate, which passes the IP blocklist check. The second calls the unauthenticated POST /api/2.0/mlflow/webhooks/<id>/test endpoint to trigger delivery. The attacker's server returns a 302 redirect to an internal address such as the AWS instance metadata service. MLflow follows the redirect without re-validating the target, and the /test endpoint reflects the full response body back to the caller, giving the attacker direct read access to cloud credentials or other internal service responses.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor MLflow webhook registrations for target URLs resolving to internal or link-local addresses, then correlate with a subsequent call to that webhook's test endpoint. A legitimate webhook points at an externally reachable receiver, so the registered target is the discriminating signal.
- Audit outbound HTTP connections from the MLflow server process for requests to link-local address ranges or internal RFC1918 addresses, which should never appear in normal webhook delivery traffic and indicate a redirect-follow to an internal target.
Remediation
Additional hardening
- Upgrade MLflow to version 3.15.0 or later, which fixes the redirect-follow bypass by pinning the validated IP address and preventing re-resolution after the initial guard check.
- Place the MLflow tracking server behind a network egress filter that blocks outbound connections to link-local ranges and internal RFC1918 addresses, preventing the server from reaching cloud metadata services even if the SSRF path is triggered.
- Enable the optional MLflow authentication plugin so that webhook creation and the /test endpoint require valid credentials, removing the unauthenticated attack surface on default deployments.
- Restrict the MLflow server's IAM role or instance profile to the minimum permissions required, so that even if metadata credentials are read, their blast radius is contained.
Key dates
References
- https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939
- https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
- https://github.com/mlflow/mlflow/issues/24179
- https://github.com/mlflow/mlflow/pull/24258
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-64849
- https://github.com/mlflow/mlflow/releases/tag/v3.15.0
Frequently asked questions
Does CVE-2026-64849 affect my FedRAMP authorization?
If MLflow runs inside your authorization boundary, CVE-2026-64849 affects your FedRAMP authorization directly. CISA has listed this vulnerability in its Known Exploited Vulnerabilities catalog, with a remediation deadline of September 2, 2026. An unpatched Known Exploited Vulnerability inside your boundary is an assessor finding. You must remediate it or formally document a mitigation before your assessor and sponsoring agency raise it during review.
How does Knox help me handle CVE-2026-64849?
Knox does not patch your MLflow instance. Under the FedRAMP shared-responsibility model, that remediation is yours to execute. What Knox provides is the pre-authorized, single-tenant boundary in which you carry out that work, plus Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. The patch is your responsibility; maintaining a compliant posture while you apply it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a vulnerability like CVE-2026-64849, that means exposure surfaces during continuous monitoring rather than waiting for an assessor to flag it at scheduled review time, giving you more time to act before a deadline becomes a finding.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-64849 isn't remediated by September 2, 2026?
If CVE-2026-64849 is not remediated by September 2, 2026, it becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Meeting the deadline keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
