MLflow Vulnerability Allows SSRF via Webhook Functionality

A server-side request forgery (SSRF) vulnerability has been identified in MLflow's webhook functionality, enabling authenticated remote attackers to initiate arbitrary requests on affected systems. The vulnerability, tracked as CVE-2026-64849, carries a CVSS score of 6.8, indicating a moderate severity level.

Exploitation of this flaw requires an attacker to first gain authentication to the targeted MLflow installation. Once authenticated, the attacker can then leverage the vulnerability within the webhook test request handling mechanism. The core issue stems from insufficient validation of Uniform Resource Identifiers (URIs) before the system attempts to access resources.

By manipulating these requests, an attacker can trick the MLflow service into making requests to arbitrary internal or external resources. This capability can be used to disclose information in the context of the service account running MLflow, potentially revealing sensitive data or internal network configurations. The SSRF vulnerability does not allow for direct code execution but rather facilitates reconnaissance and data exfiltration by redirecting the server's network requests.

MLflow, an open-source platform for managing the machine learning lifecycle, is widely used for experiment tracking, model packaging, and deployment. Its webhook feature allows for automated actions to be triggered based on events within MLflow, making this vulnerability a significant concern for organizations relying on the platform for their MLOps workflows.

The vulnerability was reported to the vendor on June 16, 2026, and a coordinated public release of the advisory occurred on October 29, 2026. The vendor, MLflow, has since issued an update to address this security flaw. Details regarding the fix can be found in the pull request here.

This advisory was published by the Zero Day Initiative (ZDI), with credit given to Minh Giang (@itscysamu) of TrendAI Zero Day Initiative for discovering and reporting the vulnerability. Users are strongly advised to apply the available update to mitigate the risk of exploitation.

The SSRF vulnerability highlights the ongoing security challenges in complex software platforms, particularly those that handle external network requests based on user-provided input. Proper input validation and access controls are crucial to prevent such vulnerabilities from being exploited, especially in systems that operate with elevated privileges or access sensitive resources.