CVE-2026-64849 2

Vulnerability (CVE)

ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability

Cyber Risks Zero Day Initiative Oct 29, 2026

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned:...

Vulnerabilities & Patching

CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability

Known Exploited Vulnerabilities CISA KEV Catalog Aug 19, 2026

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.

Vulnerabilities & Patching