External risk intelligence

MLflow Webhooks SSRF to Internal Services

CVE advisoryKnown Exploit

CVE-2026-64849

MLflow is commonly deployed as an internet-facing or network-accessible management platform and API service for machine learning operations. The affected endpoint is part of the API surface, which is often exposed in organizational environments to facilitate integration and webhook operations.

Server-Side Request Forgery

Lfprojects Mlflow

before 3.15.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

MLflow, an open-source platform for AI engineering, has a vulnerability where an unauthenticated user can potentially access internal or cloud metadata services. This could allow an attacker to retrieve sensitive information or compromise systems that provide metadata. The issue is addressed in version 3.15.0.

Webhooks can be tricked to expose sensitive data.
MLflow is a critical platform for AI and machine learning operations.
Confirm MLflow usage and assess exposure to internal services.

Attack Path

How an attacker could exploit the issue

An attacker can trigger this vulnerability by sending a specially crafted request to the MLflow API's webhook test endpoint. This endpoint, when processing the webhook URL, does not consistently validate the redirected URL, allowing an attacker to guide the request towards sensitive internal or cloud metadata services. The response from these services, including status and body, can then be exposed to the attacker.

No authentication required.
Triggered by calling a webhook test endpoint.
Exposes internal service details.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to interact with internal or cloud metadata services by exploiting a weakness in how MLflow handles webhook URLs. When a webhook is tested, the system may not properly validate the final resolved URL after redirects, potentially exposing sensitive information.

Internal or cloud metadata services.
Unauthenticated POST request to webhook endpoint.
Disclosure of metadata service response data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for MLflow, such as platform or AI/ML engineering teams, should lead the response. The initial step involves identifying all MLflow instances, assessing their network exposure and business criticality, and locating the accountable owner before planning remediation based on risk.

MLflow platform or AI/ML engineering teams.
Verify network exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MLflow?

MLflow is an open-source platform used by engineers to manage the lifecycle of machine learning models, large language models, and AI agents. It functions as a central management hub for AI operations, often hosting APIs that allow teams to automate workflows, track experiments, and configure system integrations like webhooks.

What does CVE-2026-64849 mean?

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability. It occurs when a system is tricked into making requests to unintended locations. In this case, the MLflow webhook validation logic fails to check the final destination after a URL redirect, allowing the system to be manipulated into communicating with services it should not reach.

How can an attacker trigger this vulnerability?

An attacker can trigger this by sending an unauthenticated POST request to the MLflow webhook test endpoint. Crucially, the bug is not triggered by simple, direct requests to a validated URL. It is specifically activated when the attacker provides a URL that utilizes redirects, causing the system to re-resolve the target and bypass initial security checks.

Is my MLflow instance at risk?

According to Halo Surface Signal, this vulnerability is most relevant if your MLflow instance is internet-facing or reachable via a network. Because MLflow is frequently deployed to support external integrations, instances accessible from outside your local environment are at the highest risk, as they can be forced to interact with sensitive internal or cloud metadata services.

What should I do to address this issue?

Begin by identifying all running MLflow instances and verifying their network configuration to understand if they are exposed. Determine which instances are critical to your operations and verify your current version. The primary remediation is to update to MLflow version 3.15.0 or later, which correctly handles URL validation to prevent unauthorized access to internal services.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.