Server-Side Request Forgery (SSRF) in MLflow - CVE-2026-64849

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information from internal services and perform limited server-side requests to internal endpoints.

The vulnerability exists due to server-side request forgery (SSRF) in the MLflow webhook delivery and test_webhook endpoint when following HTTP redirects or re-resolving hostnames after validating the original webhook URL. A remote attacker can create a webhook pointing to an attacker-controlled HTTPS endpoint and trigger the unauthenticated test request to disclose sensitive information from internal services and perform limited server-side requests to internal endpoints.

On default servers, the webhook API is exposed without authentication, the first hop must use HTTPS, and the synchronous /api/2.0/mlflow/webhooks/{id}/test endpoint reflects the upstream response body to the caller. DNS rebinding can also bypass the validation because the validated IP is not pinned to the connection.

Affected software

How to mitigate CVE-2026-64849

External References

• https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j
• https://github.com/mlflow/mlflow/commit/ba94952247

Related Security Bulletins

• Server-Side Request Forgery (SSRF) in MLflow