CVE-2026-64849 Mlflow Mlflow
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in…
- CVSS
- 9.3 Critical
- EPSS
- 10%
- Percentile
- 96
- Published
- 2026-08-17
- Force
- 10 of 12
- Public PoC
- 5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
On CISA’s exploited list
MLflow Server-Side Request Forgery Vulnerability
- Added
- 2026-08-19
- Federal patch deadline
- 2026-09-02
- Ransomware use
- not known