These OSV and GitHub advisory ranges apply only to the named package and ecosystem. A listed fixed version is not a universal product patch or proof that an update is installed.
Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.
1 current
CVE-2026-64849 · CSAF 2.0 · revision 3 · finalRed Hat Product Securitymlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
8 fixed
The vendor explicitly identifies these products or versions as containing the fix.
registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:2feba54cbd221a4786bcab320c8438816b0632df71f82f23b123ed4a4a111210_ppc64le as a component of Red Hat OpenShift AI 3.4
registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:304991bad591fadfed03b7f56ff6c265a6416e2e13fe02129dc253db4e13092f_s390x as a component of Red Hat OpenShift AI 3.4
registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4cf62283b344149cbdaab95c7045df607d101745ff0657146de50087fbb2bfb5_amd64 as a component of Red Hat OpenShift AI 3.4
registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4e1d4dc5b792364e2cfb31cd20e184c01aeff4ae0fa55dfc3d68aafb2a50a7f5_arm64 as a component of Red Hat OpenShift AI 3.4
registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9@sha256:5743e64bd3a2947dc022830f2d769f4ff90daf04b3e6dcfaba6420815cdb52e5_arm64 as a component of Red Hat OpenShift AI 3.5
registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9@sha256:ada20174176992b0ee306e6eface5bff06f06a71783f3deccd530a5bc4fe80a1_amd64 as a component of Red Hat OpenShift AI 3.5
registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9@sha256:4f1a03f0801811aea4550346a041c079d1cbb80cdb6f128a513122eebe3f2cef_arm64 as a component of Red Hat OpenShift AI 3.5
registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9@sha256:5bdb27b5f11d3057f9087b1e08e68b13e107541d595cbf9066d4f7a96a472ae9_amd64 as a component of Red Hat OpenShift AI 3.5
Summary
A flaw was found in MLflow. An unauthenticated remote attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability by sending a specially crafted request to the webhook test endpoint. This occurs because the system validates only the initial URL, but then follows unvalidated HTTP redirects, allowing the attacker to bypass security controls. Successful exploitation can lead to information disclosure, enabling access to internal or cloud metadata services and sensitive data.
Remediation
For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Optional official sources
National CERT insights ?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.
Choose official national sources for this report. Each advisory shows its original language. Your selection is remembered on this device and included in shared links.
Official European source
ENISA European Vulnerability Database
Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.
1 current
ENISA EUVD identifier
EUVD-2026-60473
CISA KEV mirrored by ENISA
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
EUVD state
Present in the current official mapping
Known exploitation
Recorded by ENISA since 19 Aug 2026. Evidence sources: cisa_kev.
ENISA score
9.3 · CVSS 3.1
Advisory evidence
1 linked advisory record
Explicit mitigation evidence
Only statements that explicitly mention a fix, patch, update, workaround or mitigation are shown here.
csaf_ncscnl · NCSC-2026-0375Kwetsbaarheden verholpen in Oracle Communications
Recommended actionPatch now
CISA confirms exploitation in the wild and lists 2026-09-02 as the remediation due date.
Patch available
01
What, why and how
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
What
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
Why
The server follows an attacker-influenced destination, allowing requests to systems or services the attacker cannot reach directly.
How
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.
What
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.
Why
The server follows an attacker-influenced destination, allowing requests to systems or services the attacker cannot reach directly.
How
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.
02
Exploit reality and attack path
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
Observed exploitation ?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.Confirmed in the wild
CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2026-08-19.
Public PoC / exploit material ?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.Reference recorded
A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.
Likely attack path
a network path → Server-Side Request Forgery (SSRF) → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface
Network
Privileges required
None: unauthenticated exploitation is possible
User interaction
None
Attack complexity
Low: no specialised conditions are recorded
Security boundary
Changed: exploitation can affect a different security authority
Weakness ?CWE means Common Weakness Enumeration: a standard category for the underlying weakness.
CWE-918: Server-Side Request Forgery (SSRF). The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS vector ?CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SChangedScope: The attack can affect a component governed by a different security authority.CHighConfidentiality impact: A successful attack can cause a major loss.ILowIntegrity impact: A successful attack can cause a limited loss.ANoneAvailability impact: No direct loss is represented by this metric.
Post-exploitation / living off the land
No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.
Only matched European and national findings are included. Language selectors and unavailable sources are omitted.
ENISA EUVD · EUVD-2026-60473Known-exploited evidence recorded
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
Official EUVD record ↗BSI · German · WID-SEC-2026-3403Oracle Communications: Mehrere Schwachstellen
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Official advisory ↗BSI · German · WID-SEC-2026-2946MLflow: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in MLflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Daten offenzulegen oder zu manipulieren.
Official advisory ↗Canadian Centre for Cyber Security · English · AV26-832MLflow security advisory (AV26-832)
As of August 17, 2026, MLflow is affected by vulnerabilities in the following product:
On August 19, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-64849 to their Known Exploited Vulnerabilities (KEV) Database.
Official advisory ↗INCIBE-CERT · Spanish · falsificacion-de-solicitudes-del-lado-del-servidor-ssrf-no-autenticado-en-mlflowFalsificación de solicitudes del lado del servidor (SSRF) no autenticado en MLflow
MLflow ha informado de una vulnerabilidad de severidad crítica que, en caso de ser explotada, podría permitir a un atacante acceder a la API de webhooks del registro de modelos sin autenticación.
Server-Side Request Forgery (SSRF). Amikor a webszerver fogad egy URL-t vagy hasonló kérést nem biztosítja kellőképpen hogy a megfelelő helyről került-e beszerzésre annak tartalma.
Official advisory ↗JVN iPedia · Japanese · JVNDB-2026-029152lfprojectsのmlflowにおけるサーバサイドのリクエストフォージェリの脆弱性
MLflow에서 발생하는 Server-Side Request Forgery (SSRF) 취약점(CVE-2026-64849) [1][2]
Official advisory ↗KISA KrCERT/CC · Korean · KNVD-6918美 CISA 발표 주요 Exploit 정보공유(Update. 2026-08-19)
MLflow Server-Side Request Forgery Vulnerability
Official advisory ↗NCSC-NL · Dutch · NCSC-2026-0375Kwetsbaarheden verholpen in Oracle Communications
MLflow versions prior to 3.15.0 and Oracle Communications Unified Assurance versions 6.1.1 to 7.0.0 contain SSRF and unauthorized access vulnerabilities that expose internal or cloud metadata services and critical data via improper URL validation and redirect handling.
Operational remediation based on structured source evidence.
Status ?Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.
For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Workaround
A mitigation or workaround reference is available from the source linked below; validate it against the affected product and version.
Official vendor articles2 stored documents
Linked articles are downloaded and versioned as source evidence. A CVE mention or approved update relationship does not, by itself, verify a fix for every product branch.
Release v3.15.0 · mlflow/mlflow · GitHub →Original publisher ↗Searchable text snapshot · Captured 27 Sep 2026mlflow
/
mlflow
Public
Notifications
You must be signed in to change notification settings
Fork
6.4k
Star
28.2k
Code
Issues
1.5k
Pull requests
646
Discussions
Actions
Projects
Wiki
Security and quality
7
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Wik
Affected versionsThe structured affected or fixed version information changed.
Before
mlflow: >= 3.3.0, < 3.15.0 · Fixed: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
After
mlflow: >= 3.3.0, < 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
Affected versionsThe structured affected or fixed version information changed.
Before
mlflow: < 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
After
mlflow: >= 3.3.0, < 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
Affected versionsThe structured affected or fixed version information changed.
Before
mlflow: < 3.15.0 · Fixed: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
After
mlflow: < 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
Affected versionsThe structured affected or fixed version information changed.
Before
mlflow: >= 3.3.0, < 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
After
mlflow: >= 3.3.0, < 3.15.0 · Fixed: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Affected versionsThe structured affected or fixed version information changed.
Before
mlflow: < 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
After
mlflow: < 3.15.0 · Fixed: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Affected versionsThe structured affected or fixed version information changed.
Before
Fixed: registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:2feba54cbd221a4786bcab320c8438816b0632df71f82f23b123ed4a4a111210_ppc64le as a component of Red Hat OpenShift AI 3.4; registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:304991bad591fadfed03b7f56ff6c265a6416e2e13fe02129dc253db4e13092f_s390x as a component of Red Hat OpenShift AI 3.4; registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4cf62283b344149cbdaab95c7045df607d101745ff0657146de50087fbb2bfb5_amd64 as a component of Red Hat OpenShift AI 3.4; registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4e1d4dc5b792364e2cfb31cd20e184c01aeff4ae0fa55dfc3d68aafb2a50a7f5_arm64 as a component of Red Hat OpenShift AI 3.4
After
Fixed: registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:2feba54cbd221a4786bcab320c8438816b0632df71f82f23b123ed4a4a111210_ppc64le as a component of Red Hat OpenShift AI 3.4; registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:304991bad591fadfed03b7f56ff6c265a6416e2e13fe02129dc253db4e13092f_s390x as a component of Red Hat OpenShift AI 3.4; registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4cf62283b344149cbdaab95c7045df607d101745ff0657146de50087fbb2bfb5_amd64 as a component of Red Hat OpenShift AI 3.4; registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4e1d4dc5b792364e2cfb31cd20e184c01aeff4ae0fa55dfc3d68aafb2a50a7f5_arm64 as a component of Red Hat OpenShift AI 3.4; registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9@sha256:5743e64bd3a2947dc022830f2d769f4ff90daf04b3e6dcfaba6420815cdb52e5_arm64 as a component of Red Hat OpenShift AI 3.5; registry.redhat.io/rhoai/odh-latency-predictor-prediction-rhel9@sha256:ada20174176992b0ee306e6eface5bff06f06a71783f3deccd530a5bc4fe80a1_amd64 as a component of Red Hat OpenShift AI 3.5; registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9@sha256:4f1a03f0801811aea4550346a041c079d1cbb80cdb6f128a513122eebe3f2cef_arm64 as a component of Red Hat OpenShift AI 3.5; registry.redhat.io/rhoai/odh-latency-predictor-training-rhel9@sha256:5bdb27b5f11d3057f9087b1e08e68b13e107541d595cbf9066d4f7a96a472ae9_amd64 as a component of Red Hat OpenShift AI 3.5
Affected versionsThe structured affected or fixed version information changed.
Before
mlflow: < 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
After
mlflow: < 3.15.0 · Fixed: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Affected versionsThe structured affected or fixed version information changed.
Before
rhoai/odh-mlflow-rhel9 as a component of Red Hat OpenShift AI (RHOAI)
After
Fixed: registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:2feba54cbd221a4786bcab320c8438816b0632df71f82f23b123ed4a4a111210_ppc64le as a component of Red Hat OpenShift AI 3.4; registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:304991bad591fadfed03b7f56ff6c265a6416e2e13fe02129dc253db4e13092f_s390x as a component of Red Hat OpenShift AI 3.4; registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4cf62283b344149cbdaab95c7045df607d101745ff0657146de50087fbb2bfb5_amd64 as a component of Red Hat OpenShift AI 3.4; registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4e1d4dc5b792364e2cfb31cd20e184c01aeff4ae0fa55dfc3d68aafb2a50a7f5_arm64 as a component of Red Hat OpenShift AI 3.4
Affected versionsThe structured affected or fixed version information changed.
Before
mlflow: < 3.15.0 · Fixed: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
After
mlflow: < 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
Affected versionsThe structured affected or fixed version information changed.
Before
< 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
After
mlflow: < 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
Affected versionsThe structured affected or fixed version information changed.
Before
< 3.15.0 · Fixed: No fixed version is explicitly recorded in the structured CVE data.
After
< 3.15.0 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
Technical terms and abbreviations used in this report
CVE
Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS
Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS
Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE
Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA
CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP
Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD
National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT
A computer security incident response team that publishes warnings or coordinates incident response.
PoC
Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF
Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL
Living off the land: abuse of legitimate tools or system functions during an attack.
BlackTreeCVE Intelligence