Latest / The Digital Warfare Podcast
EP. 147: CVE-2026-64849 Turns MLflow Into a Cloud Credential Theft Path
Summary
CVE-2026-64849 is a critical unauthenticated SSRF vulnerability in MLflow’s webhook delivery functionality. A remote attacker can bypass URL validation using HTTP redirects or DNS rebinding, causing the MLflow server to access internal services or cloud metadata endpoints and return the response content. The flaw carries a CVSS score of 9.3.
The vulnerability affects MLflow releases before 3.15.0. The corrected implementation validates the actual connection peer, including redirect destinations, closing the path to internal and metadata services.
Organizations should patch…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.