CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
1 advisories matched
2026-08-17
MLflow Webhook Test Endpoint Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-64849)
[Affected Scope] MLflow versions from 3.3.0 prior to 3.15.0
[Impact] Unauthenticated attackers can bypass URL validation to access internal network resources or cloud metadata services, potentially retrieving sensitive credentials and response data.
[Mitigation] Immediately upgrade MLflow to version 3.15.0 or later, and restrict access to the webhook test endpoint in the interim.