MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) (CVE-2026-64849)
MLflow versions prior to 3.15.0 contain a critical vulnerability in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. The vulnerability arises because the _validate_webhook_url() function only validates the original URL, but the webhook delivery process follows HTTP redirects and re-resolves hostnames without enforcing address pinning. This allows attackers to bypass validation via unvalidated HTTP redirects and DNS rebinding, potentially accessing internal or cloud metadata services and retrieving response data. The issue is fixed in MLflow version 3.15.0.
AI Analysis
Technical Summary
MLflow's webhook testing endpoint prior to version 3.15.0 improperly validates webhook URLs by only checking the original URL before following HTTP redirects. The delivery mechanism follows redirects and re-resolves hostnames without pinning the validated IP address, enabling attackers to exploit unvalidated redirects and DNS rebinding to perform server-side request forgery (SSRF). This can lead to unauthorized access to internal or cloud metadata services and disclosure of response status and body. The vulnerability is addressed in version 3.15.0.
Potential Impact
An unauthenticated attacker can exploit this SSRF vulnerability to send crafted requests through the webhook testing endpoint, potentially accessing internal network resources or cloud metadata services that are normally inaccessible. This can lead to unauthorized information disclosure. No known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade MLflow to version 3.15.0 or later, where this vulnerability is fixed. The fix ensures proper validation of webhook URLs including those reached via redirects, preventing SSRF via unvalidated HTTP redirects and DNS rebinding.
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) (CVE-2026-64849)
Description
MLflow versions prior to 3.15.0 contain a critical vulnerability in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. The vulnerability arises because the _validate_webhook_url() function only validates the original URL, but the webhook delivery process follows HTTP redirects and re-resolves hostnames without enforcing address pinning. This allows attackers to bypass validation via unvalidated HTTP redirects and DNS rebinding, potentially accessing internal or cloud metadata services and retrieving response data. The issue is fixed in MLflow version 3.15.0.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
MLflow's webhook testing endpoint prior to version 3.15.0 improperly validates webhook URLs by only checking the original URL before following HTTP redirects. The delivery mechanism follows redirects and re-resolves hostnames without pinning the validated IP address, enabling attackers to exploit unvalidated redirects and DNS rebinding to perform server-side request forgery (SSRF). This can lead to unauthorized access to internal or cloud metadata services and disclosure of response status and body. The vulnerability is addressed in version 3.15.0.
Potential Impact
An unauthenticated attacker can exploit this SSRF vulnerability to send crafted requests through the webhook testing endpoint, potentially accessing internal network resources or cloud metadata services that are normally inaccessible. This can lead to unauthorized information disclosure. No known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade MLflow to version 3.15.0 or later, where this vulnerability is fixed. The fix ensures proper validation of webhook URLs including those reached via redirects, preventing SSRF via unvalidated HTTP redirects and DNS rebinding.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-mlflow-2026-64849
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-64849"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Critical
- Cvss Version
- null
Threat ID: 6a885f2dacd9273b493f82d0
Added to database: 08/21/2026, 14:22:37 UTC
Last enriched: 08/21/2026, 14:41:02 UTC
Last updated: 08/21/2026, 22:52:14 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.