CVE-2026-64849

MLflow webhook checks can be bypassed with redirects or DNS changes

MLflow project · MLflow tracking server

First documented disclosure · Review checkpoint

Summary

Webhook delivery could reach internal services and return their responses through the test endpoint.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 3.1. Severity source.

Reported activity: CISA lists this CVE in its Known Exploited Vulnerabilities catalog, added 2026-08-19. The catalog does not establish victim counts or exploitation of every affected deployment.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The guard validated the initial hostname, but subsequent connections and redirects could use another address.

Conditions required

A reachable tracking server with webhook support; default deployments can expose these routes without authentication.

Potential impact

Internal information disclosure and requests to services reachable from the MLflow host.

Affected versions and configurations

CNA: 3.3.0–before 3.15.0; the upstream advisory’s structured range begins at 3.10.0.

Fix and mitigation status

3.15.0 for the original flaw; 3.16.0 adds related IPv6-transition hardening.

Practical next steps

Upgrade to include the follow-up protections, authenticate the tracking server and limit network egress.

Operating lesson

Check the actual connected peer address, not only a hostname at validation time.

Evidence and limits

June 26 is the public issue; August 2 is the advisory and August 17 the CVE publication. The sources differ on the lower affected version. KEV confirms exploitation without identifying victims.

Sources