Full Report
The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that threat actors are now exploiting a critical vulnerability in the MLflow open-source AI engineering platform. [...]
Analysis Summary
# Vulnerability: MLflow SSRF via DNS-Rebinding in Webhook Delivery
## CVE Details
- **CVE ID:** CVE-2026-64849
- **CVSS Score:** 10.0 (Critical) - *Note: Based on the "critical" designation and unauthenticated remote access capabilities described.*
- **CWE:** CWE-918 (Server-Side Request Forgery), CWE-350 (DNS Rebinding)
## Affected Systems
- **Products:** MLflow Open-Source AI Engineering Platform
- **Versions:** All versions prior to 3.15.0
- **Configurations:** Default MLflow Tracking Servers (`mlflow server`) running with no authentication and the default SQLite backend.
## Vulnerability Description
A critical Server-Side Request Forgery (SSRF) bypass exists in MLflow's outbound webhook delivery mechanism. The flaw is rooted in the `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint, which is exposed without authentication in default configurations.
By leveraging DNS-rebinding techniques, an attacker can bypass internal network protections. The endpoint synchronously issues HTTP requests to arbitrary targets and returns the full response status and body to the requester. This allows an attacker to probe internal services, access loopback interfaces, or query cloud metadata services.
## Exploitation
- **Status:** Exploited in the wild (Added to CISA KEV Catalog as of August 19, 2026)
- **Complexity:** Low
- **Attack Vector:** Network (Remote, unauthenticated)
## Impact
- **Confidentiality:** High (Access to internal services, AWS IMDS/IAM credentials, and sensitive cloud metadata)
- **Integrity:** High (Potential to modify configurations or interact with internal admin services)
- **Availability:** Medium (Potential for port scanning and service disruption)
## Remediation
### Patches
- **MLflow version 3.15.0** or later addresses this vulnerability. Users are urged to upgrade immediately.
### Workarounds
- **Enable Authentication:** Configure the MLflow Tracking Server with robust authentication mechanisms to prevent unauthenticated access to the webhooks API.
- **Network Segmentation:** Place the MLflow server behind a network boundary (e.g., VPN or Firewall) to restrict access to authorized users only.
- **Egress Filtering:** Implement strict outbound firewall rules on the MLflow host to block requests to cloud metadata IP addresses (e.g., `169.254.169.254`) and internal loopback ranges.
## Detection
- **Indicators of Compromise:**
- Unusual POST requests to `/api/2.0/mlflow/webhooks/*/test`.
- Outbound connections from the MLflow server to internal IP ranges or the cloud metadata service IP (`169.254.169.254`).
- **Detection Methods:** Monitor MLflow server logs for unauthorized access to the webhooks endpoint and review network flow logs for anomalous lateral movement or credential exfiltration patterns.
## References
- MLflow Security Advisory: hxxps[://]github[.]com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
- CISA KEV Catalog: hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- NVD Detail: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-64849