Executive Summary
A critical Server-Side Request Forgery (SSRF) vulnerability in MLflow (CVE-2026-64849, CVSS 9.3) has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog following widespread in-the-wild exploitation. MLflow, a ubiquitous open-source platform for managing machine learning lifecycles and model registries, contains a flaw in its webhook delivery mechanism that allows unauthenticated remote attackers to bypass validation logic via HTTP redirects and DNS rebinding. Attackers are weaponizing this flaw to access internal cloud instance metadata services (IMDS), stealing IAM credentials, cloud API tokens, and model artifacts from exposed enterprise AI/ML clusters.
Vulnerability Metric
Detail
CVE Identifier
CVE-2026-64849
CVSS Score
9.3 (Critical)
Affected Component
MLflow Tracking Server (Webhook Subsystem)
Exploitation Status
Active / CISA KEV Listed
Deep-Dive Technical Analysis
The vulnerability exists within the MLflow Tracking Server's webhook notification and endpoint testing subsystem, specifically located in the internal URL validator function _validate_webhook_url.
When a webhook endpoint is submitted or tested via MLflow REST APIs, the server performs an initial IP/domain check to prevent loopback (127.0.0.1) and private network (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) connections. However, the subsequent HTTP request handling in the webhook dispatcher fails to re-validate destination targets when encountering HTTP 301/302 redirects.
Attackers establish an external domain under their control (e.g., attacker-redirector.com) that initially resolves to a benign public IP address to pass the initial validation filter. Upon receiving the outbound request from the MLflow server, the attacker's server immediately returns an HTTP 302 redirect pointing to cloud metadata endpoints, such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS or http://metadata.google.internal/computeMetadata/v1/ on GCP.
Because MLflow's underlying HTTP client automatically follows redirects without re-invoking _validate_webhook_url, the server issues a local link request to the instance metadata service (IMDS). In environments lacking IMDSv2 token enforcement or custom HTTP header restrictions, the full payload response—including IAM session tokens, secret keys, and cluster configurations—is returned in the response body of the test call, granting remote attackers immediate, unauthenticated cloud access.
Additionally, researchers demonstrated that the validator is susceptible to Time-of-Check to Time-of-Use (TOCTOU) DNS rebinding, where a domain with a 0-second TTL initially resolves to a public IP during the validation check and instantly flips to 169.254.169.254 or 127.0.0.1 during the socket connection phase.
Industry Impact & Risk Assessment
The weaponization of CVE-2026-64849 represents a critical escalation in attacks targeting AI infrastructure:
* Cloud Account Compromise: Exposed MLflow servers frequently run on powerful cloud GPU instances provisioned with broad IAM permissions for S3/GCS model storage and training data access. Extracting IMDS credentials provides immediate lateral movement into core cloud infrastructure.
* Proprietary Model Theft & Poisoning: Attackers with exfiltrated bucket permissions can download proprietary weights, training datasets, and fine-tuning configurations, or inject poisoned weights directly into production pipelines.
* CISA KEV Binding Directive: Due to observed threat actor campaigns targeting exposed tracking servers across healthcare, financial, and tech sectors, CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies patch or isolate MLflow instances within strict deadlines.
Mitigation Strategies & Recommendations
To neutralize the risk posed by CVE-2026-64849, organizations should immediately implement the following defenses:
* Upgrade MLflow: Upgrade MLflow tracking servers to version 3.15.0 or later, which incorporates recursive redirect validation and patched DNS resolution guards.
* Enforce IMDSv2: On AWS EC2/EKS instances, enforce IMDSv2 (Session-Oriented Metadata Service) and set the HttpPutResponseHopLimit to 1 on containerized hosts to prevent multi-hop SSRF exploitation.
* Isolate Tracking Servers: Never expose MLflow tracking servers (default port 5000) directly to the public internet without authentication. Place them behind a reverse proxy with strict SSO/MFA authentication, or restrict access via VPN/Zero-Trust Network Access (ZTNA).
* Outbound Egress Filtering: Apply strict network security group (NSG) and egress firewall policies preventing AI/ML cluster nodes from initiating arbitrary outbound HTTP/HTTPS requests to the public internet.