MLflow SSRF (CVE-2026-64849) confirmed under active in-the-wild exploitation, added to CISA KEV with federal remediation mandate

CISA added CVE-2026-64849 (CVSS 9.3) to its Known Exploited Vulnerabilities catalog on 2026-08-19, confirming active exploitation of an unauthenticated SSRF in MLflow's webhook-test/redirect-handling logic that lets remote attackers reach cloud metadata services and steal IAM credentials. This is a material escalation from the disclosure-stage reporting already logged on 2026-08-19 in the prior digest — CISA's KEV addition confirms live exploitation and imposes a binding two-week federal remediation deadline.

MLflow is one of the most widely deployed open-source AI/ML lifecycle platforms; an unauthenticated SSRF that reaches cloud metadata endpoints is a direct path to full cloud-account compromise for any organization running ML training/experiment infrastructure with weak network segmentation, and KEV status confirms this is not theoretical — active mass scanning and credential theft is already occurring.

Unauthenticated SSRF via the webhook-test endpoint (POST /api/2.0/mlflow/webhooks/{id}/test) and webhook redirect handling, allowing an attacker to coerce the MLflow server into making arbitrary outbound requests to internal services or cloud metadata endpoints (AWS IMDSv1, GCP metadata) and receive the response body.

MLflow (open-source AI/ML experiment tracking and model registry platform) versions prior to 3.15.0

Upgrade to MLflow ≥3.15.0. Disable IMDSv1 in favor of IMDSv2 on cloud-hosted MLflow instances; restrict network egress from MLflow servers; do not expose the webhook-test endpoint to untrusted networks.