MLflow
No CISA KEV deadline is open. CISA last added a MLflow CVE on 19 Aug.
Tracked since 18 Aug · latest article Thu 20 Aug · RSS
Exploited, by due date
CSV downloadDeadlines passed
Products
1 product · 1 CVE in coverage5 articles from 4 outlets since 18 Aug; the latest 67 days ago.
- Article
- First report
- Official notice
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 20 Aug · 12:17 UTC | SecurityWeek | MLflow SSRF flaw leaks secrets, CISA urges immediate patch |
| Thu 20 Aug · 10:01 UTC | Security Affairs | SSRF bug in MLflow (CVE-2026-64849) exposes cloud secrets |
| Wed 19 Aug · 20:06 UTC | CISA | CISA flags MLflow SSRF flaw CVE-2026-64849 in KEV catalog |
| Wed 19 Aug · 19:31 UTC | CISA | CISA Adds CVE-2026-64849 to Known Exploited Vulnerabilities Catalogue |
| Tue 18 Aug · 13:41 UTC | SecurityOnline | MLflow SSRF flaw CVE-2026-64849 exposes internal services |
Who reported 4 outlets, last 12 months
- CISA2
- SecurityOnline1
- Security Affairs1
- SecurityWeek1
- MLflow SSRF flaw leaks secrets, CISA urges immediate patchSecurityWeek
- SSRF bug in MLflow (CVE-2026-64849) exposes cloud secretsSecurity Affairs
- CISA flags MLflow SSRF flaw CVE-2026-64849 in KEV catalogCISA · official notice
- CISA Adds CVE-2026-64849 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- MLflow SSRF flaw CVE-2026-64849 exposes internal servicesSecurityOnline
All CVEs in coverage
1How these numbers are made
CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.
CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.
Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.
Product names are grouped by normalised names, with version and edition tails removed.
Fix listed refers to an advisory. Unknown fix status is counted as not listed.