MLflow Server-Side Request Forgery Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.3Security Advisory

TL;DR 📌

  • MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
  • Highest CVSS: 9.3 (Critical).
  • Listed in CISA KEV (2026-08-19) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-64849.

What it is

CVE-2026-64849 is a server-side request forgery (SSRF) vulnerability in MLflow. The CVSS vector indicates the flaw is reachable over the network, requires no authentication and no user interaction, and can be exploited with low attack complexity.

The vulnerability allows an attacker to make MLflow issue requests on their behalf, including to internal services or cloud metadata endpoints that would not normally be reachable from outside. The attacker receives back the response status and response body, giving them a way to read data from those internal targets rather than merely triggering a request blind.

The CVSS scope is marked as changed, and the vector shows a high confidentiality impact with a low integrity impact and no effect on availability. In practice, this points to disclosure of information from systems behind the MLflow server — for example, credentials or configuration exposed via cloud metadata services — rather than to modification of MLflow data or denial of service.

This CVE is listed in the CISA Known Exploited Vulnerabilities catalogue, added on 19 August 2026, so it is known to be exploited.

What to do

  • Treat this as urgent given the unauthenticated, network-reachable path and confirmed exploitation. Check whether your MLflow deployment is internet-facing or reachable from untrusted networks and restrict access immediately if so.
  • The advisory does not list a fixed release yet — consult the advisory directly for updates and apply a patch as soon as one is published.
  • In the meantime, restrict outbound network access from the MLflow server, particularly to cloud metadata endpoints (e.g. via instance metadata service protections or network policy), to limit what an SSRF can reach.
  • Review MLflow server logs for unexpected outbound requests or unusual request parameters that could indicate SSRF attempts.
  • If MLflow runs in a cloud environment, confirm that metadata service protections (such as IMDSv2 or equivalent) are enforced, as this reduces the impact of SSRF reaching those endpoints even before a patch is available.

For leadership 🧭

Executive summary. Risk is Critical (CVSS 9.3) across any MLflow kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source