Full Report
MLflow security advisory (AV26-832)
Analysis Summary
# Vulnerability: Unauthenticated Full-Read SSRF in MLflow Webhook Delivery
## CVE Details
- **CVE ID:** CVE-2026-64849
- **CVSS Score:** 9.8 (Critical) *(Assigned based on CISA KEV and GHSA impact)*
- **CWE:** CWE-918 (Server-Side Request Forgery), CWE-601 (Open Redirect)
## Affected Systems
- **Products:** MLflow
- **Versions:** All versions prior to 3.15.0
- **Configurations:** Systems where MLflow Model Registry webhooks are enabled or reachable, particularly those in cloud environments (AWS, GCP, Azure) where metadata services are accessible via internal networking.
## Vulnerability Description
A critical Server-Side Request Forgery (SSRF) vulnerability exists in the MLflow webhook delivery mechanism. The flaw resides in the `_validate_webhook_url` function, which is intended to prevent requests to internal or restricted IP addresses.
Attackers can bypass these validations using two primary techniques:
1. **Unvalidated HTTP Redirects:** The validator only checks the initial URL. An attacker can provide a URL to a malicious server that returns a 30x redirect to an internal resource (e.g., `http://169.254.169.254`).
2. **DNS Rebinding:** Exploiting the time-of-check to time-of-use (TOCTOU) gap between the validation of the hostname and the actual HTTP request execution.
This allows an unauthenticated attacker to force the MLflow server to make arbitrary requests to internal services, potentially leading to the theft of cloud infrastructure credentials or internal data.
## Exploitation
- **Status:** **Exploited in the wild.** (Added to CISA Known Exploited Vulnerabilities Catalog on August 19, 2026).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full read access to internal metadata services and private network resources)
- **Integrity:** Medium (Potential to interact with internal APIs)
- **Availability:** Low
## Remediation
### Patches
- **Update to MLflow version 3.15.0 or later.** This version includes enhanced validation logic that follows redirects during the validation phase and implements protections against DNS rebinding.
### Workarounds
- **Network Segmentation:** Restrict the MLflow server's outbound network access to prevent it from reaching internal management IPs (e.g., 169.254.169.254) and other sensitive internal services.
- **Disable Webhooks:** If not required, disable the webhook functionality within the MLflow configuration.
## Detection
- **Indicators of Compromise:** Unusual outbound HTTP requests from the MLflow server to internal IP ranges or cloud metadata services.
- **Log Analysis:** Review MLflow logs for webhook registration events originating from unauthorized or unexpected external IP addresses. Monitor for 30x redirect patterns in outbound traffic originating from the MLflow service.
## References
- **Vendor Advisory:** hxxps[://]github[.]com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849
- **Release Notes:** hxxps[://]github[.]com/mlflow/mlflow/releases/tag/v3.15.0