CVE-2026-64849
Covered in 2 advisories
Radar advisories
- 2026-10-29 ZDI ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability MLflow's webhook server can be abused for server-side request forgery. Exploitation requires valid authentication.
- 2026-08-19 CISA CISA KEV — MLflow (CVE-2026-64849) CVE-2026-64849, an SSRF flaw in MLflow, has been added to CISA’s KEV catalog due to active exploitation.
References
- NVD ↗
- CVE.org ↗
- CISA KEV catalogue ↗ listed as known exploited
- Zero Day Initiative ↗