{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-64849",
    "name": "CVE-2026-64849",
    "vendor": "MLflow",
    "description": "An unauthenticated server-side request forgery in MLflow's model-registry webhooks lets an attacker proxy requests through the server into internal services, including cloud metadata endpoints, and leave with cloud credentials and secrets. It defeats the earlier fixes for this class through the way it handles redirects. Honeypot telemetry showed indiscriminate scanning for exposed MLflow instances within hours of the CVE being assigned on 17 August, and CISA added it to the Known Exploited Vulnerabilities catalog on 19 August with a 2 September federal remediation deadline.",
    "website": "https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-18",
    "risk": {
      "score": 93,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-64849",
      "aliases": [
        "ti-079"
      ],
      "title": "CVE-2026-64849: MLflow SSRF Exploited Within Hours and Added to CISA KEV (CVSS 9.3)",
      "summary": "An unauthenticated server-side request forgery in MLflow's model-registry webhooks lets an attacker proxy requests through the server into internal services, including cloud metadata endpoints, and leave with cloud credentials and secrets. It defeats the earlier fixes for this class through the way it handles redirects. Honeypot telemetry showed indiscriminate scanning for exposed MLflow instances within hours of the CVE being assigned on 17 August, and CISA added it to the Known Exploited Vulnerabilities catalog on 19 August with a 2 September federal remediation deadline.",
      "severity": "critical",
      "cvss": {
        "score": 9.3,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Server-side request forgery"
      ],
      "componentType": "agent",
      "component": {
        "name": "MLflow",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "MLflow < 3.15.0",
          "fixed": "3.15.0"
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-08-18",
      "modifiedAt": "2026-08-18",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/08/attackers-exploit-mlflow-ssrf-flaw-to.html"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64849"
        }
      ],
      "mitigation": "Upgrade MLflow to 3.15.0 or later now, because this is being scanned for indiscriminately rather than targeted. Take any MLflow instance off the public internet and block its egress to cloud metadata endpoints (169.254.169.254) so an SSRF cannot convert into cloud credentials. Rotate the instance role credentials if it was internet-reachable before patching.",
      "detectedByAnomity": true
    }
  }
}