CVE-2026-64849 Scanner

MLflow is an open-source platform used by data scientists and developers for managing the machine learning lifecycle. It is designed to track experiments, manage machine learning models, and streamline the ML pipeline in order to improve efficiency and collaboration. MLflow is often deployed within enterprise environments to manage extensive data workflows and deployments seamlessly. Organizations leverage MLflow's capabilities for scalable experimentation and reproducible research. Integration with various cloud platforms and on-premise infrastructures allows diverse applications in different sectors. Because MLflow handles sensitive data and models, maintaining its security posture is paramount.

In the MLflow platform, a Server-Side Request Forgery (SSRF) vulnerability was identified which can be exploited by unauthorized individuals. This specific security flaw allows attackers to misuse webhooks for reaching and probing internal or cloud metadata services. The vulnerability stems from improper validation of webhook URLs, which can be manipulated to bypass intended access controls. Given the critical nature of this oversight, it poses a high risk of information disclosure. Attackers may exploit this to leak sensitive data or craft further attacks against the affected infrastructure.

This vulnerability resides in the post-authentication webhook management where the attackers manipulate the URL parameters. The use of unchecked redirection targets leads to improperly handling URL endpoints and DNS rebinding requests. The test endpoint for webhook URLs does not adequately safeguard against these misuse patterns, opening a path for attacks. During exploitation, messages are forcibly redirected to internal resources, bypassing the firewall restrictions present. The flaw exists specifically in MLflow versions above 3.15.0 and is marked by external influences tricking internal system calls via crafted webhook entries.

If exploited, this SSRF vulnerability may result in the exposure of confidential environment variables and internal cloud resources. Unauthorized users might access metadata services that can reveal sensitive configurations or secret keys. Furthermore, exploiting these flows can serve as a vector to network reconnaissance efforts, potentially leading to more severe compromises. Services that rely on these internal communications become vulnerable to data interception and unauthorized data manipulations. In worst-case scenarios, further exploitation might allow attackers to escalate privileges or deploy additional malicious payloads.

REFERENCES

• https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
• https://github.com/mlflow/mlflow/pull/24258