MLflow CVE-2026-64849

Exploitation requires the MLflow webhooks feature and network reachability to the POST /api/2.0/mlflow/webhooks/{id}/test endpoint, which is unauthenticated (PR:N) - so no credentials are needed. The attacker must control a webhook target URL that either passes the initial _validate_webhook_url() public-IP check and then redirects to an internal address, or resolves to a public IP at validation and a private/link-local IP at delivery (DNS rebinding). Payoff is greatest when the server runs in a cloud environment exposing an instance metadata service (169.254.169.254) or has reachable internal services. Limiting factors: the target must expose the webhooks API to the attacker (internal-only deployments sharply reduce risk), a valid webhook {id} context for the test flow, and - for the credential-theft case - a cloud metadata endpoint reachable from the server; IMDSv2 or egress filtering blunts the highest-impact outcome.

The signals align toward genuine priority for exposed instances. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, 9.3) indicates a network-reachable, low-complexity, unauthenticated attack with a scope change - consistent with the description's 'unauthenticated POST' endpoint and the ability to reach cross-boundary metadata services. AC:L is credible because the redirect-following path allows a trivial bypass (no DNS-rebinding infrastructure required), even though the rebinding path adds complexity. The primary limiting factor is exposure: MLflow tracking servers are frequently deployed on internal networks, so realistic risk concentrates on internet-exposed or multi-tenant deployments, especially those running in cloud environments with an instance metadata service. No KEV listing and no confirmed POC are present in the provided data, so this is not confirmed active exploitation; EPSS was not supplied. SSVC was not provided, but the technical impact is high (credential exfiltration) and the attack is plausibly automatable against exposed hosts. Net: high-priority for any cloud-hosted or externally reachable MLflow instance; lower urgency for strictly network-isolated deployments.

An attacker with network access to an internet-exposed MLflow server sends POST /api/2.0/mlflow/webhooks/{id}/test pointing at an attacker-controlled host that passes the public-IP check, then HTTP-redirects (or DNS-rebinds) the delivery request to http://169.254.169.254/latest/meta-data/iam/security-credentials/. MLflow follows the redirect, re-resolves the target, and returns the metadata service's response_body to the attacker, exposing cloud IAM credentials. No POC is identified in the available data, but the low attack complexity and unauthenticated endpoint make exploitation straightforward against exposed instances.