{"uuid": "284e16f3-f63c-443a-82c5-c5532db8df86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://gist.github.com/alon710/9d43dd3bb8cad3aff005a6b8be53e64d", "content": "# CVE-2026-64849: CVE-2026-64849: Server-Side Request Forgery (SSRF) in MLflow Webhooks via DNS Rebinding\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-64849\n\n## Summary\nCVE-2026-64849 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting MLflow tracking servers prior to version 3.15.0. It allows unauthenticated remote attackers to bypass outbound request destination filters using DNS rebinding or HTTP redirects. This exposure risks compromising sensitive cloud infrastructure metadata and internal microservices.\n\n## TL;DR\nA Time-of-Check to Time-of-Use (TOCTOU) vulnerability in MLflow webhooks allows unauthenticated remote attackers to bypass IP constraints and extract sensitive local or cloud metadata credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.3\n- **Vulnerability Type**: Server-Side Request Forgery (SSRF)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- MLflow Tracking Server\n- **MLflow**: < 3.15.0 (Fixed in: `3.15.0`)\n\n## Mitigation\n\n- Upgrade MLflow to version 3.15.0 or later to enable socket-level validation.\n- Implement host-level firewall configurations to restrict outbound network requests to internal spaces.\n- Place MLflow behind an authentication gateway or configure local authentication to restrict access.\n\n**Remediation Steps:**\n1. Identify current MLflow running instances and check their versions using Python command.\n2. If the version is prior to 3.15.0, schedule an immediate package upgrade.\n3. Apply firewalls limiting egress to private and link-local IP addresses as a temporary workaround if an upgrade cannot be executed.\n4. Ensure environment configurations do not expose local proxies to the MLflow execution environment.\n\n## References\n\n- [GitHub Security Advisory GHSA-7gwp-5pfp-969j](https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j)\n- [GitHub Issue Discussion #24179](https://github.com/mlflow/mlflow/issues/24179)\n- [GitHub Fixing Pull Request #24258](https://github.com/mlflow/mlflow/pull/24258)\n- [GitHub Security Patch Commit](https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939)\n- [MLflow v3.15.0 Release Notes](https://github.com/mlflow/mlflow/releases/tag/v3.15.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-64849) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-18T00:32:32.384543Z"}