CISA added CVE-2026-64849 to its Known Exploited Vulnerabilities catalogue after confirming active exploitation of a server side request forgery flaw in the MLflow tracking server. The flaw lets unauthenticated attackers trick the server into contacting internal or cloud metadata services and leaking their responses.
Tracked as CVE-2026-64849 the issue carries a CVSS v3.1 score of 9.3 rating it critical according to a securityonline.info report. It resides in the webhook endpoint of the default tracking server and does not require any authentication to be triggered. Versions prior to 3.15.0 are vulnerable.
The fix released in MLflow 3.15.0 adds peer IP validation at each connection stage to block abusive requests. Details of the advisory are available from the project’s security advisory. Users are urged to apply the update promptly.
CISA s KEV entry notes that the flaw is under active exploitation in the wild although no specific threat actors have been linked to the attacks so far. Successful abuse can expose internal network details or cloud provider metadata potentially providing footholds for further intrusions.
Server side request forgery weaknesses are often chained with other bugs to escalate privileges or move laterally. Leakage of cloud metadata can reveal access keys or tokens that compromise broader environments.
Defenders should upgrade to MLflow 3.15.0 or later as soon as possible apply the vendor patch and limit network exposure of the tracking server to trusted hosts. Monitoring outbound HTTP requests for unexpected internal or metadata IP addresses can help detect exploitation attempts and disabling the webhook feature when not needed reduces the attack surface. Reviewing logs for repeated SSRF like patterns is also advised.