Webhook Validation Flaw in MLflow Affects Data Integrity
CVE-2026-64849

9.3CRITICAL

Key Information:

Vendor

Mlflow

Status
Mlflow
Vendor
CVE Published:
17 August 2026

What is CVE-2026-64849?

MLflow, the open-source AI engineering platform, contains a flaw in its webhook validation process. The issue resides in the POST /api/2.0/mlflow/webhooks/{id}/test endpoint, which neglects to fully validate URLs when processing redirects. This oversight can permit attackers to access internal or cloud-based metadata services, potentially exposing sensitive response data. This vulnerability has been addressed in version 3.15.0, where enhanced validation ensures secure handling of webhook URLs.

Affected Version(s)

mlflow < 3.15.0

References

https://github.com/mlflow/mlflow/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/mlflow/mlflow/issues/24179
x_refsource_MISC
https://github.com/mlflow/mlflow/pull/24258
x_refsource_MISC

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.