MLflow Server-Side Request Forgery Vulnerability (CVE-2026-64849)

What happened

MLflow, the open-source platform for managing machine learning workflows, contains a server-side request forgery (SSRF) vulnerability tracked as CVE-2026-64849. The flaw allows attackers to force the MLflow server to issue HTTP requests to arbitrary internal or cloud metadata endpoints and retrieve both the response status and response body. CISA added CVE-2026-64849 to the Known Exploited Vulnerabilities catalog on August 19, 2026, signaling active exploitation in the wild.^{[source-1, source-2, source-3]}

The vulnerability enables adversaries to reach internal services that are typically shielded from external access, including cloud provider metadata APIs that expose instance credentials, configuration data, and secrets. Because MLflow servers often run in cloud environments with elevated permissions to orchestrate training jobs and access model registries, the impact of successful SSRF exploitation extends beyond information disclosure to potential lateral movement and privilege escalation.^[source-1]

Why it matters

CISA's inclusion of CVE-2026-64849 in the KEV catalog confirms that threat actors are actively exploiting this vulnerability in production environments. Organizations running MLflow in cloud infrastructure face immediate risk of credential theft, data exfiltration, and unauthorized access to machine learning pipelines and training data.^[source-1]

The EPSS score for CVE-2026-64849 is 0.1641, placing it in the 96.73rd percentile of all tracked vulnerabilities. This elevated probability of exploitation reflects both the public availability of exploit information and the attractiveness of MLflow deployments as targets. Machine learning platforms frequently handle sensitive datasets, proprietary models, and API keys for downstream services, making them high-value objectives for attackers seeking intellectual property or supply chain footholds.^[source-1]

SSRF vulnerabilities in server-side applications are particularly dangerous because they bypass network perimeter controls. An attacker who can manipulate the MLflow server into making requests on their behalf can probe internal network topology, enumerate services, and interact with cloud metadata endpoints that assume requests originate from trusted sources. In AWS environments, for example, the instance metadata service at 169.254.169.254 provides temporary credentials that can be used to assume IAM roles and access S3 buckets, databases, and other resources.^[source-1]

Affected systems and exposure path

CVE-2026-64849 affects MLflow servers exposed to untrusted networks or accessible to authenticated users who may be malicious or compromised. While specific affected versions are not confirmed in the available evidence, organizations should consult vendor advisories and the linked NVD and CVE records to determine whether their deployments are vulnerable.^{[source-1, source-2, source-3]}

The exposure path typically involves an HTTP endpoint in the MLflow server that accepts user-supplied URLs or parameters used to construct outbound requests. Common attack vectors include:^[source-1]

MLflow deployments in cloud environments are especially vulnerable because the server often runs with IAM roles or service principals that grant broad access to storage, compute, and secrets management services. An attacker who successfully exploits the SSRF can query the instance metadata service to retrieve temporary credentials, then use those credentials to escalate privileges, access sensitive data, or pivot to other cloud resources.^[source-1]

On-premises MLflow installations are also at risk if the server can reach internal services such as databases, configuration management systems, or monitoring platforms. The ability to retrieve response bodies means attackers can exfiltrate data from internal APIs, enumerate network services, and identify additional targets for lateral movement.^[source-1]

Technical detail

Server-side request forgery occurs when an application accepts user input to construct an outbound HTTP request without properly validating the destination. In the case of CVE-2026-64849, the MLflow server processes attacker-controlled input and uses it to initiate requests to arbitrary URLs. The vulnerability is particularly severe because the server returns both the HTTP status code and the full response body to the attacker, enabling complete information disclosure from the targeted endpoint.^[source-1]

The EPSS score of 0.1641 and percentile ranking of 96.73 indicate that this vulnerability has a higher-than-average likelihood of exploitation compared to the broader CVE population. This elevated risk is driven by the combination of public disclosure, active exploitation confirmed by CISA, and the strategic value of MLflow deployments in enterprise environments.^[source-1]

Typical exploitation follows this sequence:^[source-1]

Because the vulnerability allows retrieval of response bodies, attackers can extract structured data such as JSON-formatted credentials, XML configuration files, or plaintext secrets. This capability distinguishes CVE-2026-64849 from blind SSRF vulnerabilities where attackers can only infer success or failure based on timing or side effects.^[source-1]

Detection and triage

Detecting exploitation of CVE-2026-64849 requires monitoring outbound HTTP requests from MLflow servers and correlating them with application logs and network telemetry. Security teams should prioritize detection in environments where MLflow is deployed in cloud infrastructure or has access to internal services.^[source-1]

Network-level detection focuses on identifying outbound requests to suspicious destinations:^[source-1]

Application-level detection involves analyzing MLflow server logs and API request patterns:^[source-1]

Cloud-native detection leverages platform-specific telemetry:^[source-1]

Triage should prioritize incidents where outbound requests successfully reached metadata endpoints or internal services and returned data. Review the response logs to determine what information was exposed, then assess the scope of potential credential compromise or data exfiltration. If temporary credentials were retrieved, audit all API calls made using those credentials to identify unauthorized access or lateral movement.^[source-1]

Remediation and compensating controls

Organizations should apply mitigations in accordance with vendor instructions as soon as patches or updated versions become available. Consult the MLflow project's security advisories, GitHub repository, and release notes to identify the fixed version and upgrade path.^[source-1]

Until patches can be deployed, implement the following compensating controls to reduce exposure:^[source-1]

For organizations that cannot immediately patch or implement network controls, consider temporarily disabling external access to MLflow and restricting usage to trusted internal users over VPN or private network connections. This reduces the attack surface while remediation is in progress.^[source-1]

After applying patches, validate that the vulnerability is no longer exploitable by testing the previously vulnerable endpoints with known SSRF payloads. Ensure that requests to metadata endpoints and internal services are blocked or sanitized, and verify that response bodies are not returned to the client when invalid URLs are submitted.^[source-1]

Validation evidence

Confirming successful remediation requires testing the patched MLflow server to ensure that SSRF attempts are blocked and that no sensitive information is disclosed. Validation should be performed in a controlled environment before deploying patches to production.^[source-1]

Test the following scenarios to verify that CVE-2026-64849 is no longer exploitable:^[source-1]

Network-level validation involves confirming that egress controls are enforced:^[source-1]

Application-level validation includes reviewing configuration changes and access controls:^[source-1]

Document validation results and retain evidence of successful testing for compliance and audit purposes. If any SSRF attempts succeed after remediation, investigate whether additional vulnerable endpoints exist or whether compensating controls are misconfigured.^[source-1]

Operational pitfalls

Patching MLflow in production environments can introduce operational challenges, especially when the platform is tightly integrated with machine learning pipelines, CI/CD workflows, and data processing systems. Teams should anticipate and plan for the following pitfalls:^[source-1]

Dependency conflicts and compatibility issues may arise when upgrading MLflow, particularly if the deployment relies on specific versions of Python libraries, model serialization formats, or API endpoints. Test the patched version in a staging environment with representative workloads to identify breaking changes before deploying to production. Review the MLflow release notes and migration guides to understand deprecated features and required configuration updates.^{[source-1, source-2, source-3]}

Network egress restrictions can disrupt legitimate operations if not carefully scoped. MLflow servers often need to fetch model artifacts from external storage services, retrieve training data from remote APIs, or send notifications to external monitoring platforms. Before implementing blanket egress blocks, inventory all external dependencies and create allowlists for required destinations. Monitor application logs after deploying network controls to identify and resolve connectivity issues.^[source-1]

IAM permission reductions may break automated workflows if roles or service principals are overly restricted. Machine learning pipelines frequently require access to storage buckets, compute resources, and secrets management services, and reducing permissions without understanding the full scope of operations can cause training jobs to fail or model deployments to stall. Conduct a thorough audit of MLflow's access patterns and test permission changes in a non-production environment before applying them broadly.^[source-1]

Incomplete remediation is a common risk when multiple MLflow instances are deployed across development, staging, and production environments. Ensure that patches and compensating controls are applied consistently to all instances, including those managed by individual teams or deployed in isolated cloud accounts. Use configuration management tools and infrastructure-as-code to enforce uniform security policies and prevent configuration drift.^{[source-1, source-2, source-3]}

False positives in detection rules can overwhelm security teams if monitoring is not tuned to the specific behavior of MLflow. Legitimate model fetching operations may generate outbound HTTP requests that resemble SSRF attempts, especially if models are stored in internal repositories or accessed via IP addresses. Refine detection logic to focus on requests to known-sensitive endpoints such as metadata services and localhost, and correlate alerts with user activity and application context to reduce noise.^[source-1]

Delayed vendor guidance can complicate remediation planning, especially if affected versions and patch availability are not immediately clear. In the absence of detailed vendor advisories, prioritize implementing compensating controls and monitoring while awaiting official guidance. Engage with the MLflow community through GitHub issues, mailing lists, and security channels to stay informed about emerging details and recommended mitigations.^{[source-2, source-3]}

BlackShield context

Security teams managing MLflow deployments can use BlackShield to connect prioritized findings for CVE-2026-64849 to remediation guidance and ownership, ensuring patches and mitigations are tracked and applied systematically across affected instances.