DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-64849: CVE-2026-64849: Server-Side Request Forgery (SSRF) in MLflow Webhooks via DNS Rebinding

#security #cve #cybersecurity

CVE-2026-64849: Server-Side Request Forgery (SSRF) in MLflow Webhooks via DNS Rebinding

Vulnerability ID: CVE-2026-64849
CVSS Score: 9.3
Published: 2026-08-17

CVE-2026-64849 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting MLflow tracking servers prior to version 3.15.0. It allows unauthenticated remote attackers to bypass outbound request destination filters using DNS rebinding or HTTP redirects. This exposure risks compromising sensitive cloud infrastructure metadata and internal microservices.

TL;DR

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in MLflow webhooks allows unauthenticated remote attackers to bypass IP constraints and extract sensitive local or cloud metadata credentials.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS v3.1 Score: 9.3
  • Vulnerability Type: Server-Side Request Forgery (SSRF)
  • Exploit Status: poc
  • CISA KEV Status: Not Listed

Affected Systems

  • MLflow Tracking Server
  • MLflow: < 3.15.0 (Fixed in: 3.15.0)

Code Analysis

Commit: ba94952

Fix outbound SSRF in webhook delivery via socket connection level interception

Exploit Details

Mitigation Strategies

  • Upgrade MLflow to version 3.15.0 or later to enable socket-level validation.
  • Implement host-level firewall configurations to restrict outbound network requests to internal spaces.
  • Place MLflow behind an authentication gateway or configure local authentication to restrict access.

Remediation Steps:

  1. Identify current MLflow running instances and check their versions using Python command.
  2. If the version is prior to 3.15.0, schedule an immediate package upgrade.
  3. Apply firewalls limiting egress to private and link-local IP addresses as a temporary workaround if an upgrade cannot be executed.
  4. Ensure environment configurations do not expose local proxies to the MLflow execution environment.

References

Read the full report for CVE-2026-64849 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)