CVE-2026-64849: MLflow SSRF Exploited Within Hours and Added to CISA KEV (CVSS 9.3)
CVE-2026-64849 is a critical-severity server-side request forgery issue (CVSS 9.3) in MLflow, an AI agent. Affected: MLflow < 3.15.0. Fixed in 3.15.0. It has been exploited in the wild.
Is MLflow running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-64849- Severity
- critical
- CVSS score
- 9.3
- Attack type
- Server-side request forgery
- Component
- MLflow · AI agent
- Known exploited
- Yes
- Published
- Last verified
What is CVE-2026-64849?
An unauthenticated server-side request forgery in MLflow's model-registry webhooks lets an attacker proxy requests through the server into internal services, including cloud metadata endpoints, and leave with cloud credentials and secrets. It defeats the earlier fixes for this class through the way it handles redirects. Honeypot telemetry showed indiscriminate scanning for exposed MLflow instances within hours of the CVE being assigned on 17 August, and CISA added it to the Known Exploited Vulnerabilities catalog on 19 August with a 2 September federal remediation deadline.
Affected versions
| Affected | Fixed in |
|---|---|
MLflow < 3.15.0 | 3.15.0 |
Am I affected by CVE-2026-64849?
You are affected if you run MLflow < 3.15.0. Versions 3.15.0 and later include the fix.
How do I fix CVE-2026-64849?
Upgrade MLflow to 3.15.0 or later now, because this is being scanned for indiscriminately rather than targeted. Take any MLflow instance off the public internet and block its egress to cloud metadata endpoints (169.254.169.254) so an SSRF cannot convert into cloud credentials. Rotate the instance role credentials if it was internet-reachable before patching.
How do I find every machine running MLflow?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run MLflow and which version, then enforce a policy on it.