https://www.phllaps.net/tags/mlflow/ Recent content in MLflow on PhllapsNET Hugo en-gb Wed, 19 Aug 2026 00:00:00 +0000 https://www.phllaps.net/posts/mlflow-server-side-request-forgery-vulnerability/ Wed, 19 Aug 2026 00:00:00 +0000 https://www.phllaps.net/posts/mlflow-server-side-request-forgery-vulnerability/ <div style="background:#b91c1c;color:white;padding:16px 18px;border-radius:14px;font-weight:800;font-size:18px;display:flex;align-items:center;gap:12px;box-shadow:0 10px 24px rgba(0,0,0,0.18);"><span style="font-size:24px;">🚨</span><span>SEVERITY: CRITICAL — CVSS 9.3</span><span style="opacity:0.95;font-weight:700;margin-left:auto;">Security Advisory</span></div> <h2 id="tldr-">TL;DR 📌</h2> <ul> <li>MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.</li> <li>Highest CVSS: <strong>9.3 (Critical)</strong>.</li> <li><strong>Listed in CISA KEV</strong> (2026-08-19) — this is being exploited in the wild.</li> <li><strong>Check the advisory for fixed releases</strong> — remediation detail is in the vendor link below.</li> <li>CVEs: CVE-2026-64849.</li> </ul> <h2 id="what-it-is">What it is</h2> <p>CVE-2026-64849 is a server-side request forgery (SSRF) vulnerability in MLflow. The CVSS vector indicates the flaw is reachable over the network, requires no authentication and no user interaction, and can be exploited with low attack complexity.</p>