Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-64849

CVE-2026-64849CRITICAL

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  L  N    9.3   .0984   95.4   YES

AFFECTED
  Product  Versions              Fixed
  mlflow   >= 3.3.0, < 3.15.0 –  —

TIMELINE
  Jul 20  Reserved by GitHub_M
  Aug 17  Published (CNA: GitHub_M)
  Aug 19  ADDED TO KEV — CVE-2026-64849 (mlflow). Remediation due September 2, 2026.
  Aug 20  EXPLOIT PUBLISHED — CVE-2026-64849 (mlflow). Public exploit reference added.
  Sep 3   DUE DATE PASSED — CVE-2026-64849 (mlflow). CISA remediation deadline was September 2, 2026; still in catalog.
  Oct 2   EXPLOIT PUBLISHED — CVE-2026-64849 (mlflow). Public exploit reference added.

CWE-918 · CNA: GitHub_M · CVSS v3.1 · 6 references · NVD status: Modified · KEV due September 2, 2026

Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

Lifecycle

Complete event history — 6 events, chronological
Date	Event	Detail
July 20, 2026	Reserved	Reserved by GitHub_M
August 17, 2026	Published	Published (CNA: GitHub_M)
August 19, 2026	KEV ADDED	ADDED TO KEV — CVE-2026-64849 (mlflow). Remediation due September 2, 2026.
August 20, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-64849 (mlflow). Public exploit reference added.
September 3, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-64849 (mlflow). CISA remediation deadline was September 2, 2026; still in catalog.
October 2, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-64849 (mlflow). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
mlflow	mlflow	—	>= 3.3.0, < 3.15.0	—

Weaknesses

CWE-918

References (6)

https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939 [Patch]
https://github.com/mlflow/mlflow/issues/24179 [Exploit, Issue Tracking, Mitigation]
https://github.com/mlflow/mlflow/pull/24258 [Issue Tracking, Patch]
https://github.com/mlflow/mlflow/releases/tag/v3.15.0 [Release Notes]
https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j [Exploit, Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849 [US Government Resource]

Authoritative record: CVE-2026-64849 at cve.org

Vendors: mlflow

Weaknesses: CWE-918

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64849 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.