coldbraid

CVE-2026-64849 Mlflow Mlflow

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in…

CVSS
9.3 Critical
EPSS
10%
Percentile
96
Published
2026-08-17
Force
10 of 12
Public PoC
5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CWE-918

On CISA’s exploited list

MLflow Server-Side Request Forgery Vulnerability

Added
2026-08-19
Federal patch deadline
2026-09-02
Ransomware use
not known