The U.S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting CVE-2026-64849, a critical server-side request forgery flaw in the MLflow machine-learning platform. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 19, making it a priority for organizations operating reachable MLflow Tracking Servers. Public reporting on the warning was published on August 20.

MLflow is an open-source platform used to track experiments and manage machine-learning models and deployments. The upstream GitHub security advisory rates CVE-2026-64849 at 9.3 out of 10 and identifies versions before 3.15.0 as vulnerable. The Canadian Centre for Cyber Security independently advised administrators to review the notices and install the available update.

The flaw affects MLflow webhook delivery. According to the upstream advisory, the software validates the original webhook URL but can follow an HTTP redirect or resolve a hostname again without binding the connection to the address that passed validation. An unauthenticated attacker able to reach a default Tracking Server can therefore cause it to request resources at internal, loopback or cloud metadata addresses.

The webhook test endpoint can return the requested service response status and body to the caller, turning the weakness into full-read SSRF rather than a blind network probe. The advisory says this can expose cloud instance metadata, internal administrative services and information useful for mapping hosts and ports. CISA confirms known exploitation, but its catalog does not identify the attackers, victims or specific post-exploitation activity.

MLflow fixed the issue in version 3.15.0 by adding protection that checks the connected peer address, including connections opened after redirects. Operators should upgrade to 3.15.0 or later after compatibility testing. Where an immediate update is not possible, defenders can reduce exposure by requiring authentication, restricting access to the Tracking Server and webhook API, and blocking unnecessary outbound access to private and link-local networks.

Security teams should also review MLflow server and network logs for unexpected webhook tests, outbound requests to internal services and access to cloud metadata endpoints. Because CISA lists the vulnerability as exploited, internet-facing and broadly accessible instances warrant immediate inventory and remediation rather than routine patch scheduling.