MLflow webhook DNS-rebinding SSRF leaks cloud metadata credentials (CVE-2026-64849)
The flaw entered VulnCheck KEV today with CISA's SSVC decision marked active, and teams that leave MLflow tracking servers below 3.15.0 reachable this week risk cloud IAM credential theft via the instance metadata service.
MLflow's outbound webhook SSRF protection resolves and validates a hostname but lets the actual request re-resolve it independently, so an attacker-controlled DNS server can pass validation with a public IP and then rebind to 169.254.169.254 or 127.0.0.1. The attacker receives the response body, enabling theft of cloud IAM credentials and secrets from instance metadata endpoints.
Affected: MLflow < 3.15.0
How to Test
Run 'pip show mlflow' (or check the server's /version endpoint) to confirm whether you are below 3.15.0; audit configured webhooks for attacker-controlled or recently changed destination URLs; review cloud audit logs (e.g., AWS CloudTrail) for IAM credential use originating from your MLflow tracking server's role.
How to Patch
Upgrade to MLflow 3.15.0, which adds an SSRF-protected HTTP adapter that validates the peer IP at connect time and disables environment proxy handling; as interim mitigation, block egress from MLflow hosts to 169.254.169.254 and internal ranges, and enforce IMDSv2 with a hop limit of 1 on AWS instances.