MLflow Server-Side Request Forgery Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.3Security Advisory

TL;DR 📌

  • MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
  • Highest CVSS: 9.3 (Critical).
  • Listed in CISA KEV (2026-08-19) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-64849.

What it is

CVE-2026-64849 is a server-side request forgery (SSRF) vulnerability in MLflow. The CVSS vector indicates the flaw is reachable over the network, requires no authentication and no user interaction, and can be exploited with low attack complexity.

The vulnerability allows an attacker to make MLflow issue requests on their behalf, including to internal services or cloud metadata endpoints that would not normally be reachable from outside. The attacker receives back the response status and response body, giving them a way to read data from those internal targets rather than merely triggering a request blind.

The CVSS scope is marked as changed, and the vector shows a high confidentiality impact with a low integrity impact and no effect on availability. In practice, this points to disclosure of information from systems behind the MLflow server — for example, credentials or configuration exposed via cloud metadata services — rather than to modification of MLflow data or denial of service.

This CVE is listed in the CISA Known Exploited Vulnerabilities catalogue, added on 19 August 2026, so it is known to be exploited.

What to do

  • Treat this as urgent given the unauthenticated, network-reachable path and confirmed exploitation. Check whether your MLflow deployment is internet-facing or reachable from untrusted networks and restrict access immediately if so.
  • The advisory does not list a fixed release yet — consult the advisory directly for updates and apply a patch as soon as one is published.
  • In the meantime, restrict outbound network access from the MLflow server, particularly to cloud metadata endpoints (e.g. via instance metadata service protections or network policy), to limit what an SSRF can reach.
  • Review MLflow server logs for unexpected outbound requests or unusual request parameters that could indicate SSRF attempts.
  • If MLflow runs in a cloud environment, confirm that metadata service protections (such as IMDSv2 or equivalent) are enforced, as this reduces the impact of SSRF reaching those endpoints even before a patch is available.

For leadership 🧭

Executive summary. A critical, unauthenticated flaw in MLflow lets an outside attacker force the server to request internal or cloud metadata endpoints and read the results, including possible credentials, with no login or user interaction required. It is already being exploited, so any internet-facing or untrusted-network-reachable MLflow instance needs action today, not at the next patch cycle.

Why it matters:

  • MLflow can be forced to issue requests to internal services or cloud metadata endpoints and return the response_status and response_body, so an attacker can read data, not just trigger blind requests.
  • The path requires no authentication and no user interaction and is network-reachable with low attack complexity, meaning any exposed MLflow server is directly at risk.
  • High confidentiality impact suggests exposure of secrets such as cloud instance credentials retrievable via metadata services, which could then be used to pivot further into the environment.
  • This CVE is in the CISA KEV catalogue, added 19 August 2026, confirming it is being actively exploited rather than a theoretical risk.

Now / Next / Later:

  • Now: Check whether your MLflow server is reachable from the internet or from untrusted internal networks and restrict access immediately if it is.
  • Next: In the next change window, block or tightly restrict outbound network access from the MLflow server, especially to cloud metadata endpoints, and enforce IMDSv2 or equivalent metadata protections if running in a cloud environment.
  • Later: Apply the vendor’s fix once a fixed release is published, and review MLflow server logs now and going forward for unexpected outbound requests or unusual request parameters indicative of SSRF attempts.

Source