MLflow Webhook Test Endpoint Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-64849)

1. Official Patch (Recommended)

Upgrade your MLflow installation to version 3.15.0 or higher. The patch ensures that redirected URLs are properly re-validated and resolved addresses are pinned.

# Using pip
pip install --upgrade mlflow>=3.15.0

# Using poetry
poetry add mlflow@latest

2. Temporary Mitigations

If upgrading immediately is not feasible, implement the following security controls:

• WAF / Reverse Proxy Rules:

Block external access to the /api/2.0/mlflow/webhooks/*/test endpoint.

• Harden Cloud Metadata Access:

In AWS environments, enforce IMDSv2 and set the metadata response hop limit to 1 to prevent containerized applications from accessing the host's metadata service.

• Egress Network Filtering:

Configure firewall rules (e.g., Security Groups, Kubernetes NetworkPolicies) to restrict the MLflow server from making outbound requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the link-local address (169.254.169.254).

A critical Server-Side Request Forgery (SSRF, CWE-918) vulnerability has been identified in MLflow, an open-source AI engineering platform. The vulnerability resides in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint.

Root Cause & Exploit Mechanics:

• Incomplete Validation: The _validate_webhook_url() function in mlflow/utils/validation.py only validates the initial URL provided in the request.
• Redirect Handling Flaw: The actual delivery mechanism in mlflow/webhooks/delivery.py follows HTTP redirects and re-resolves the destination hostname without pinning or re-validating the resolved IP address.
• Bypass Technique: An attacker can supply a benign-looking domain that passes the initial validation, but configure that domain to redirect to internal loopback addresses (127.0.0.1) or cloud Instance Metadata Services (IMDS) (169.254.169.254). This allows the attacker to bypass the validation logic entirely and receive the response_status and response_body of the internal request.

Impact: With a CVSS score of 9.3 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability is actively exploited in the wild. Attackers can leverage this flaw to scan internal networks, access restricted local services, or extract cloud IAM credentials from IMDS, leading to potential cloud infrastructure compromise.