TI-2026-46366 Aliases CVE-2026-64849 GHSA-7gwp-5pfp-969j

Server-side request forgery in mlflow

CRITICAL 97Exploited in the wildCWE-918Published 2026-08-17 · Updated 2026-10-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

Why it matters now

Exploitation Active In CISA KEV since 2026-08-19CISA due date 2026-09-02

EPSS 0.10017 95th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed mlflow (mlflow): 3.15.0mlflow (PyPI): 3.15.0Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MLflow	mlflow	3.3.0 to before 3.15.0	3.15.0	Patch available	CNA
—	mlflow (PyPI)	3.3.0 to before 3.15.0	3.15.0	Patch available	GHSA-7gwp-5pfp-969j

mlflow VendorMLflow Affected 3.3.0 to before 3.15.0 Fixed in 3.15.0 Patch available CNA
mlflow (PyPI) Vendor— Affected 3.3.0 to before 3.15.0 Fixed in 3.15.0 Patch available GHSA-7gwp-5pfp-969j

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lfprojects:mlflow::::::::	3.3.0 to before 3.15.0	Vulnerable	MLflow

cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* Versions 3.3.0 to before 3.15.0 Vulnerable ·MLflow

Remediation

Fix · CNA mlflow (mlflow) Fixed in 3.15.0
Fix · GHSA-7gwp-5pfp-969j mlflow (PyPI) Fixed in 3.15.0 Advisory →

Red Hat 2 advisories

RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
RHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
RHSA-2026:60367 Released 2026-08-26 · Red Hat rating Critical
RHOAI 3.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9, registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift AI 3.4	Fixed	RHSA-2026:60520
Red Hat OpenShift AI 3.5	Fixed	RHSA-2026:60367

Not affected: 2 products

Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift AI 3.4

Timeline

2026-08-19 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2026-64849
2026-10-03 Alias added: GHSA-7gwp-5pfp-969j

References

Exploit 2

Patch 2

Advisory 2

Other 5

TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
TI-2023-05540 MLflow Authentication Bypass CVSS 3.1CRITICAL 9.8
TI-2023-02603 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
TI-2026-00348 Missing Authentication for Critical Function in mlflow/mlflow CVSS 3.1CRITICAL 9.8

See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences