CVE-2026-64849

Received Received - Intake

Unauthenticated Hostname Redirection in MLflow

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-64849

Affected Vendors & Products

Vendor	Product	Version / Range
mlflow	mlflow	3.15.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability in MLflow versions before 3.15.0 allows unauthenticated attackers to test webhook URLs via the POST /api/2.0/mlflow/webhooks/{id}/test endpoint. The issue occurs because the validation function only checks the original URL, while the delivery function follows redirects and re-resolves hostnames without validating the final address. This enables attackers to redirect requests to internal or cloud metadata services and capture sensitive response data.

Detection Guidance

This vulnerability can be detected by checking the MLflow version in use. If the version is below 3.15.0, the system is vulnerable. Run: pip show mlflow to check the installed version. Additionally, monitor network traffic for unauthorized POST requests to /api/2.0/mlflow/webhooks/{id}/test endpoints.

Impact Analysis

Attackers could exploit this to access internal systems or cloud metadata services, potentially stealing sensitive data like response bodies or status codes. This could lead to unauthorized information disclosure, data breaches, or further attacks within your network if metadata services are compromised.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations using affected MLflow versions may face compliance violations, legal penalties, or reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade MLflow to version 3.15.0 or later immediately. If upgrading is not possible, restrict access to the /api/2.0/mlflow/webhooks/{id}/test endpoint by implementing authentication and network-level controls to block unauthorized access.

Hi! I’m here to help you understand CVE-2026-64849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70