---
id: CVE-2026-64849
title: >-
  mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery:
  _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS …
summary: >-
  A flaw was found in MLflow. An unauthenticated remote attacker can exploit a
  Server-Side Request Forgery (SSRF) vulnerability by sending a specially
  crafted request to the webhook test endpoint. This occurs because the system
  validates onl…
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cvssSource: vendor
cwe: CWE-918
vendor: Red Hat
product: Red Hat OpenShift AI 3.4
affected:
  - openshift_ai 3.4
  - openshift_ai 3.5
patched:
  - openshift_ai 3.4
  - openshift_ai 3.5
exploited: true
published: '2026-08-17'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T10:25:11+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64849.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64849.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64849'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2517655'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64849'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64849'
  - url: >-
      https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939
  - url: 'https://github.com/mlflow/mlflow/issues/24179'
  - url: 'https://github.com/mlflow/mlflow/pull/24258'
  - url: 'https://github.com/mlflow/mlflow/releases/tag/v3.15.0'
  - url: 'https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j'
  - url: 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog'
  - url: 'https://access.redhat.com/errata/RHSA-2026:60520'
  - url: 'https://access.redhat.com/errata/RHSA-2026:60367'
  - url: 'https://github.com/advisories/GHSA-7gwp-5pfp-969j'
tags:
  - csaf
  - vex
  - red-hat
  - kev
  - in-the-wild
  - exploit-available
  - ghsa
  - pip
epss: 0.09839
epssPercentile: 0.95388
kev: true
kevDateAdded: '2026-08-19'
kevDueDate: '2026-09-02'
kevRansomware: false
exploits:
  github: 4
  githubRepos:
    - 'https://github.com/codeb0ssx/CVE-2026-64849-PoC'
    - 'https://github.com/BiuTrap/CVE-2026-64849'
    - 'https://github.com/zavisco/CVE-2026-64849.yaml'
  nuclei:
    - CVE-2026-64849
  checkedAt: '2026-09-25T08:21:07.456Z'
exploitAvailable: true
aliases:
  - GHSA-7gwp-5pfp-969j
ecosystem: pip
scores:
  vendor: 8.5
  ghsa: 9.3
ingestedAt: '2026-08-17T22:01:16.670Z'
---

## Overview

A flaw was found in MLflow. An unauthenticated remote attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability by sending a specially crafted request to the webhook test endpoint. This occurs because the system validates only the initial URL, but then follows unvalidated HTTP redirects, allowing the attacker to bypass security controls. Successful exploitation can lead to information disclosure, enabling access to internal or cloud metadata services and sensitive data.

## Vendor advisories

- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)
- **RHSA-2026:60367** · Red Hat · fixed in: Red Hat OpenShift AI 3.5 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60367)

**mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)** — rated Important by Red Hat. Released 2026-08-17, updated 2026-09-21.

Fixed:

- Red Hat OpenShift AI 3.4
- Red Hat OpenShift AI 3.5

Not affected:

- Red Hat OpenShift AI 3.4
- Red Hat OpenShift AI (RHOAI)

## Remediation

For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:60520
For Red Hat OpenShift AI 3.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:60367

Workarounds / mitigations:

- To reduce the attack surface for this vulnerability, restrict network access to the MLflow server. Implement firewall rules or network access controls to limit connectivity to the MLflow instance from untrusted networks. This operational control helps prevent unauthenticated attackers from reaching the vulnerable webhook test endpoint.

## Exploitation

Red Hat reports this vulnerability as exploited.

## Package advisory (CVE-2026-64849)

Affected packages:

- `mlflow < 3.15.0`

Patched in:

- `mlflow 3.15.0`

Source: https://github.com/advisories/GHSA-7gwp-5pfp-969j