# CVE-2026-64849 — MLflow Server-Side Request Forgery (SSRF) Vulnerability in Model Registry Webhooks

> CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities catalog on August 19, 2026, confirming active exploitation. The vulnerability is an unauthenticated full-read SSRF in MLflow (prior to v3.15.0) that allows attackers to reach internal services or cloud metadata endpoints via HTTP redirect following (302/307/308) and DNS rebinding TOCTOU bypasses of the webhook URL guard. watchTowr detected indiscriminate scanning for exposed MLflow instances within hours of CVE assignment, with attackers specifically targeting cloud metadata services to exfiltrate IAM credentials and service account tokens across AWS, GCP, and Azure environments.

- **Published:** 2026-08-19T00:00:00Z
- **Last reviewed:** 2026-10-10T01:04:19.844Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2077
- **ID:** TL-2026-2077
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-64849, CVE-2026-2393

## Description

CVE-2026-64849 is a critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow's model-registry webhooks API, affecting all versions prior to 3.15.0. The default MLflow Tracking Server (started via `mlflow server`, binding to 0.0.0.0 with no authentication plugin by default) exposes the unauthenticated `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint, which synchronously delivers webhook payloads and reflects the upstream response status and body back to the caller.

A previous SSRF guard (`_validate_webhook_url`) was added in PR #20747 (shipped in MLflow 3.10.0) to fix CVE-2026-2393. This guard resolved the webhook hostname via `socket.getaddrinfo()` and rejected non-public IPs using `ip.is_global`. However, the fix was incomplete — the resolved IP was never pinned or carried forward to the actual connection, creating a critical time-of-check/time-of-use (TOCTOU) gap.

Two distinct bypass vectors exist. First, the webhook delivery code (`mlflow/webhooks/delivery.py`) follows HTTP redirects without `allow_redirects=False` and never re-validates the redirect target. An attacker hosts a public HTTPS endpoint that passes the IP validation check, then returns a 302 redirect to an internal URL such as `http://169.254.169.254/latest/meta-data/iam/security-credentials/`. MLflow follows the redirect and reflects the response body (containing cloud IAM credentials) back to the attacker. With 307/308 redirects, the POST method and body are preserved, enabling blind writes to internal management endpoints such as Docker daemon `/stop`, Elasticsearch `/_close`, or Spring Boot Actuator `/shutdown`. The first hop must be HTTPS (the default allowed scheme), but the redirect Location may be HTTP.

Second, a DNS rebinding TOCTOU attack exploits the fact that `_validate_webhook_url` resolves the hostname independently from the subsequent `session.post(webhook.url)` call. An attacker-controlled DNS server returns a public IP during validation (passing `ip.is_global`), then switches to a private IP (e.g., 169.254.169.254) when the actual HTTP request resolves the hostname again. The existing `TrustedHostMiddleware` from PR #22095 was never applied to outbound webhook delivery. Default settings `_MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS=False` and `_MLFLOW_WEBHOOK_ALLOWED_SCHEMES=["https"]` do not prevent the rebinding attack since they operate at validation time, not at connection time.

The fix (PR #24258, commit ba94952247, shipped in MLflow 3.15.0) introduces an `SSRFProtectedHTTPAdapter` that validates the peer IP of each connected socket immediately after `connect()` and before any TLS/HTTP exchange. This covers redirect targets (each redirect opens a new connection through the protected pool) and closes both redirect-following and DNS-rebinding TOCTOU variants. The adapter also sets `trust_env=False` and overrides `proxy_manager_for` to prevent proxy bypass via `HTTP(S)_PROXY` environment variables.

watchTowr's global honeypot network detected indiscriminate scanning for exposed MLflow instances within hours of CVE assignment on August 17, 2026. Attackers are specifically targeting cloud-hosted MLflow systems and exfiltrating cloud credentials and secrets (IAM credentials, service account tokens). Shodan data indicates approximately 25,000+ publicly accessible MLflow instances, with ~740 confirmed via banner verification, and approximately 4,000+ accessible without authentication — making MLflow one of the most reliably identifiable and exposed AI tracking services. A prior coordinated exploitation campaign (GitHub issue #23500) exploiting CVE-2023-6831 and CVE-2023-42364 found 238 exposed instances with 103 confirmed compromised. No specific threat actor group has been publicly attributed to CVE-2026-64849 exploitation at this time.

CISA's SSVC assessment shifted from `exploitation:none` to `exploitation:active` on August 19, 2026, with `automatable:yes` and `technicalImpact:total`. CISA requires remediation by September 2, 2026 per BOD 26-04 guidance. The EPSS score is 1.1% (30-day), reflecting early-but-active exploitation primarily targeting high-value cloud environments rather than broad opportunistic attacks.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.001 Scanning IP Blocks
- T1595.002 Vulnerability Scanning
- T1583.001 Acquire Infrastructure: Domains
- T1583.002 Acquire Infrastructure: DNS Server
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1046 Network Service Discovery
- T1071.001 Web Protocols
- T1496 Resource Hijacking
- T1529 System Shutdown/Reboot

## Sources

- [GHSA-7gwp-5pfp-969j — MLflow SSRF Security Advisory](https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j)
- [CISA Adds One Known Exploited Vulnerability to Catalog — August 19, 2026](https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog)
- [NVD Entry — CVE-2026-64849](https://nvd.nist.gov/vuln/detail/CVE-2026-64849)
- [CISA KEV Catalog — CVE-2026-64849](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849)
- [GitHub Issue #24179 — DNS Rebinding SSRF Bypass in MLflow Webhooks](https://github.com/mlflow/mlflow/issues/24179)
- [PR #24258 — SSRFProtectedHTTPAdapter Fix](https://github.com/mlflow/mlflow/pull/24258)
- [Commit ba94952247 — Patch](https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939)
- [MLflow v3.15.0 Release Notes](https://github.com/mlflow/mlflow/releases/tag/v3.15.0)
- [Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials — The Hacker News](https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html)
- [watchTowr: CVE-2026-64849 MLflow SSRF Attacks — SecurityOnline](https://securityonline.info/mlflow-ssrf-cve-2026-64849/)
- [CVE-2026-2393 — Previous MLflow SSRF (Authenticated, fixed in 3.9.0)](https://nvd.nist.gov/vuln/detail/CVE-2026-2393)
- [CVE-2025-14279 — MLflow DNS Rebinding via Missing Origin Validation](https://nvd.nist.gov/vuln/detail/CVE-2025-14279)
- [CISA BOD 26-04 Guidance](https://www.cisa.gov/bod-26-04)
- [GitHub Issue #23500 — MLflow Exploitation Campaign](https://github.com/mlflow/mlflow/issues/23500)
- [OpenA2A — MLflow Instance Verification Study](https://opena2a.com/research/mlflow-exposure)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2077