{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mlflow--3.15.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-64849"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MLflow Tracking Server","MLflow (\u003c 3.15.0)"],"_cs_severities":["critical"],"_cs_tags":["ssrf","mlflow","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["MLflow"],"content_html":"\u003cp\u003eMLflow Tracking Server (v3.13.0 and earlier) contains an SSRF vulnerability (CVE-2026-64849) in its webhook delivery mechanism. While the application implements a validation function (\u003ccode\u003e_validate_webhook_url\u003c/code\u003e) intended to restrict connections to public IP addresses, the implementation fails to pin the resolved IP address, and the HTTP client follows redirects without re-validating the final destination. An unauthenticated attacker can create a webhook pointing to a controlled HTTPS endpoint that issues a 302 redirect to internal network resources, such as the AWS Instance Metadata Service (169.254.169.254) or loopback addresses. Because the synchronous \u003ccode\u003e/api/2.0/mlflow/webhooks/{id}/test\u003c/code\u003e endpoint reflects the response status and body back to the caller, this allows for unauthenticated full-read exfiltration of sensitive internal data or blind POST interactions with management interfaces on the local network.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an internet-facing MLflow Tracking Server instance running with a default configuration (e.g., SQLite backend) lacking authentication plugins.\u003c/li\u003e\n\u003cli\u003eAttacker prepares a malicious HTTPS-enabled server that returns a 302 HTTP redirect to an internal target (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/).\u003c/li\u003e\n\u003cli\u003eAttacker submits a POST request to \u003ccode\u003e/api/2.0/mlflow/webhooks\u003c/code\u003e with the \u003ccode\u003eurl\u003c/code\u003e parameter pointing to the malicious attacker-controlled HTTPS endpoint.\u003c/li\u003e\n\u003cli\u003eMLflow validates the initial URL; since the attacker's endpoint is a valid public HTTPS URL, the \u003ccode\u003e_validate_webhook_url\u003c/code\u003e check passes.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the SSRF by sending a request to the \u003ccode\u003e/api/2.0/mlflow/webhooks/{id}/test\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe MLflow server executes the webhook, follows the 302 redirect to the internal target without re-validation, and fetches the sensitive internal resource.\u003c/li\u003e\n\u003cli\u003eThe server receives the internal response (e.g., cloud credentials) and reflects the full response body back to the attacker in the HTTP response of the \u003ccode\u003e/test\u003c/code\u003e request.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to exfiltrate sensitive cloud metadata (e.g., IAM role credentials), query internal-only services, or perform host scanning from the perspective of the MLflow server. Furthermore, by using 307 or 308 redirects, attackers can perform blind POST operations against internal management interfaces like Docker daemons or Spring Boot Actuator endpoints, potentially leading to remote code execution or service disruption within the internal network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the following actions to secure your MLflow environment:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade MLflow to version 3.15.0 or later immediately to patch CVE-2026-64849.\u003c/li\u003e\n\u003cli\u003eEnable MLflow authentication plugins to ensure that the webhook API is not accessible to unauthenticated users.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to isolate MLflow servers from sensitive cloud metadata endpoints (IMDSv1) and internal management interfaces.\u003c/li\u003e\n\u003cli\u003eDeploy the suggested webserver-level rules to detect potential SSRF attempts directed at common internal paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T00:46:22Z","date_published":"2026-08-18T00:46:13Z","id":"https://feed.craftedsignal.io/briefs/2026-08-mlflow-ssrf/","summary":"MLflow Tracking Server versions prior to 3.15.0 are vulnerable to an unauthenticated full-read SSRF attack because the webhook delivery mechanism follows unvalidated HTTP redirects, allowing attackers to exfiltrate internal data or interact with local services.","title":"MLflow Tracking Server Unauthenticated Full-Read SSRF via Webhook Delivery","url":"https://feed.craftedsignal.io/briefs/2026-08-mlflow-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - MLflow (\u003c 3.15.0)","version":"https://jsonfeed.org/version/1.1"}