ZeroDayAlert

CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.

MLflow MLflow Added to KEV 2026-08-19 Federal due 2026-09-02 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

MLflow Server contains a server-side request forgery (SSRF) vulnerability. The flaw allows remote attackers to make the MLflow instance issue requests to internal or cloud metadata services, reading back response status and body content. This affects any organisation running MLflow as a service, whether on-premises or in cloud environments.

How to check whether this touches you

  • Inventory your MLflow deployments: check whether you run MLflow Server, and in which environments (on-premises, AWS, Azure, GCP, or other cloud).
  • Determine network exposure: establish whether each MLflow instance is reachable from untrusted networks—check ingress rules, DNS records, and whether it sits behind a load balancer or API gateway.
  • Confirm the running version: query the MLflow service version via its web interface or API; note that security patches may be backported to earlier minor versions by your distributor.
  • Check access logs for suspicious requests: look for unusual URI patterns, repeated metadata service URLs, or requests from unexpected IP ranges pointing to internal services.

What to do

  1. If you cannot patch immediately, restrict network access to MLflow Server to only trusted clients and internal networks; use firewall rules, security groups, or network policies to deny external inbound connections.
  2. Review and tighten IAM policies on the host or container running MLflow to limit its outbound access to only required services; disable access to cloud metadata endpoints if possible.
  3. Enable and review access logs for the MLflow service, looking for requests that target internal IP ranges, localhost, or known cloud metadata service endpoints (such as 169.254.169.254).
  4. Apply the vendor's patch or mitigations as soon as feasible, following CISA BOD 26-04 guidance for your environment and asset classification.
  5. If mitigations or patches are unavailable for your deployment model, escalate to leadership and consider discontinuing use of the product pending vendor remediation.

If you find you were exposed

Exploitation of SSRF vulnerabilities typically occurs before public disclosure, so review access and request logs covering the period back to the vulnerability's likely introduction date. Pay particular attention to outbound connections from the MLflow host to internal services, cloud metadata endpoints, or other sensitive infrastructure. Log retention policies often limit historical visibility; prioritise retention of access logs and network flow data for MLflow instances going forward, and document any suspicious patterns you find for incident investigation.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-64849 is being exploited. It cannot tell you whether MLflow is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →