MLflow SSRF Flaw (CVE-2026-64849) Hands Attackers Your Cloud Credentials

CVE-2026-64849 is a server-side request forgery flaw affecting all MLflow releases before 3.15.0. It sits in the model-registry webhooks feature, specifically the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. A default Tracking Server (mlflow server) runs without authentication on a local SQLite backend, so this webhook API is often exposed to untrusted traffic straight out of the box.

The root cause is an incomplete security check. The _validate_webhook_url() helper added in version 3.10.0 blocks private and cloud metadata addresses, but only inspects the first URL. The delivery code in mlflow/webhooks/delivery.py then follows HTTP redirects and re-resolves the hostname without pinning the validated address. An attacker can host a public URL that passes the initial check and returns an HTTP 302 redirect to a link-local metadata service or internal loopback address, and because the hostname is re-resolved after the check, the flaw is also open to DNS-rebinding attacks.

What turns this MLflow flaw from a typical SSRF into a full-read primitive is the test endpoint's behavior: instead of just firing the webhook, it reflects the upstream HTTP status and response body to the caller. The attacker therefore receives the actual contents of whatever internal or cloud resource was reached. On AWS, Azure, and Google Cloud, this exposes temporary IAM credentials, OAuth tokens, and environment configuration from the metadata address at 169.254.169.254, along with internal microservices and loopback admin consoles that trust the host.

Active exploitation of CVE-2026-64849 is not theoretical. A honeypot network reported attackers targeting internet-exposed MLflow instances within hours of the CVE being assigned. A public proof-of-concept is also available, including a confirmed reproduction against MLflow 3.13.0, and the flaw was independently disclosed in public GitHub issue #24179. The vulnerability is fixed in MLflow 3.15.0, and defenders should assume opportunistic mass exploitation is ongoing.