{"uuid": "5a36664e-1d7c-493f-ae6f-b7ac6e2f652d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64849", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mthil7nmgd2u", "content": "MLflow has an unauthenticated SSRF (CVE-2026-64849, CVSS 9.3) that reaches cloud metadata and returns the response, so it reads your instance credentials.\n\nEvery version before 3.15.0 is affected. Now on CISA's KEV list.\n\nPatch to 3.15.0 and enforce IMDSv2.", "creation_timestamp": "2026-08-19T19:44:41.593709Z"}